CVE-2023-38309
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in Webmin 2.021 in the package search functionality. An attacker can inject a malicious payload in the 'Search for Package' field, leading to the execution of arbitrary JavaScript code within the context of the victim's browser.
Risk Assessment
This vulnerability may lead to session data theft or account takeover by attackers. Organizations should be aware of the risks associated with the exploitation of this vulnerability.
Recommendation
It is recommended to update Webmin to the latest version to mitigate this vulnerability. Additionally, implementing security mechanisms against XSS attacks is advisable.
Original NVD description (English source)
An issue was discovered in Webmin 2.021. A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the package search functionality. The vulnerability allows an attacker to inject a malicious payload in the "Search for Package" field, which gets reflected back in the application's response, leading to the execution of arbitrary JavaScript code within the context of the victim's browser.