CVE-2023-38311
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Webmin 2.021 in the System Logs Viewer functionality. The vulnerability allows an attacker to store a malicious payload in the configuration field, triggering the execution of the payload when saving the configuration or when accessing the System Logs Viewer page.
Risk Assessment
This vulnerability may lead to the execution of malicious code in the user's context, posing a risk of data theft or session hijacking. Organizations should be aware of potential attacks exploiting this flaw.
Recommendation
It is recommended to update Webmin to the latest version to mitigate this vulnerability. Additionally, conducting a configuration audit and monitoring system logs for potential attack attempts is advisable.
Original NVD description (English source)
An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the System Logs Viewer functionality. The vulnerability allows an attacker to store a malicious payload in the configuration field, triggering the execution of the payload when saving the configuration or when accessing the System Logs Viewer page.