CVE-2023-38307
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Webmin 2.021 in the Users and Groups functionality. The issue occurs when an authenticated user adds a new user and inserts an XSS payload into the user's real name.
Risk Assessment
This vulnerability could allow malicious code to be executed in the browsers of other users, posing a risk of data theft or session hijacking.
Recommendation
It is recommended to update Webmin to the latest version and implement input validation in user addition forms.
Original NVD description (English source)
An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality. The vulnerability occurs when an authenticated user adds a new user and inserts an XSS payload into the user's real name.