CVE-2023-38305
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
An issue was discovered in Webmin 2.021 related to the download functionality, allowing an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing a crafted download path containing a malicious payload, an attacker can inject arbitrary code, which is then executed within the context of the victim's browser when the download link is accessed.
Risk Assessment
This vulnerability poses a risk of executing malicious code in users' browsers, potentially leading to data theft or session hijacking. Organizations should be aware of the potential security implications for their users.
Recommendation
It is recommended to update Webmin to the latest version to mitigate this vulnerability. Additionally, implementing input validation mechanisms can help minimize the risk of XSS attacks.
Original NVD description (English source)
An issue was discovered in Webmin 2.021. The download functionality allows an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing a crafted download path containing a malicious payload, an attacker can inject arbitrary code, which is then executed within the context of the victim's browser when the download link is accessed.