CVE-2023-38306
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A Cross-site Scripting (XSS) Bypass vulnerability was discovered in the file upload functionality of Webmin 2.021. An attacker can bypass restrictions on uploading certain file types, such as .svg or .php, and inject malicious code.
Risk Assessment
This vulnerability may lead to malicious code injection, posing a serious threat to the application's security and user data.
Recommendation
It is recommended to update Webmin to the latest version and implement additional security measures to protect against XSS attacks.
Original NVD description (English source)
An issue was discovered in Webmin 2.021. A Cross-site Scripting (XSS) Bypass vulnerability was discovered in the file upload functionality. Normally, the application restricts the upload of certain file types such as .svg, .php, etc., and displays an error message if a prohibited file type is detected. However, by following certain steps, an attacker can bypass these restrictions and inject malicious code.