CVE Catalog
CVE-2023-38303
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk0.71%
49th percentile - higher than 49% of all known CVEs
Summary
An issue was discovered in Webmin 2.021 that allows for a stored Cross-Site Scripting (XSS) attack to achieve Remote Command Execution (RCE) through the Users and Group's real name parameter.
Risk Assessment
An attacker could gain access to the system and execute arbitrary commands, posing a serious security threat to the organization.
Recommendation
It is recommended to update Webmin to the latest version and monitor the users and groups' parameters for potential attacks.
Original NVD description (English source)
An issue was discovered in Webmin 2.021. One can exploit a stored Cross-Site Scripting (XSS) attack to achieve Remote Command Execution (RCE) through the Users and Group's real name parameter.