CVE-2023-38310
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the configuration settings of the system logs functionality in Webmin 2.021. An attacker can store an XSS payload in the configuration settings of specific log files, leading to its execution whenever those log files are accessed.
Risk Assessment
This vulnerability may allow the execution of malicious code in the user's browser context, posing a risk of data theft or session hijacking. Organizations should be aware of the potential security implications.
Recommendation
It is recommended to update Webmin to the latest version to mitigate this vulnerability. Additionally, conducting an audit of the log configuration settings to detect and remove potential XSS payloads is advisable.
Original NVD description (English source)
An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the configuration settings of the system logs functionality. The vulnerability allows an attacker to store an XSS payload in the configuration settings of specific log files. This results in the execution of that payload whenever the affected log files are accessed.