CVE-2023-38308
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A Cross-Site Scripting (XSS) vulnerability was discovered in Webmin 2.021 in the HTTP Tunnel functionality when handling third-party domain URLs. An attacker can inject malicious code, leading to the execution of arbitrary JavaScript code within the context of the victim's browser.
Risk Assessment
This vulnerability could allow attackers to hijack user sessions or steal data, posing a significant security threat to the organization.
Recommendation
It is recommended to update Webmin to the latest version and implement URL filtering to minimize the risk of XSS attacks.
Original NVD description (English source)
An issue was discovered in Webmin 2.021. A Cross-Site Scripting (XSS) vulnerability was discovered in the HTTP Tunnel functionality when handling third-party domain URLs. By providing a crafted URL from a third-party domain, an attacker can inject malicious code. leading to the execution of arbitrary JavaScript code within the context of the victim's browser.