CVE-2023-40985
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
In Webmin 2.100, a Cross-Site Scripting (XSS) vulnerability was found in the File Manager functionality. An attacker can inject malicious code that executes in the victim's browser during file search or replace operations.
Risk Assessment
The risk includes potential session hijacking, data theft, or unauthorized actions performed in the victim's context. This attack can compromise data confidentiality and integrity within the system.
Recommendation
Immediately upgrade Webmin to a version newer than 2.100 that includes a fix for this vulnerability. Additionally, implement input filtering and output encoding in the File Manager functionality.
Original NVD description (English source)
An issue was discovered in Webmin 2.100. The File Manager functionality allows an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing a malicious payload, an attacker can inject arbitrary code, which is then executed within the context of the victim's browser when any file is searched/replaced.