Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their server are vulnerable to this XSS vulnerability that could be used to execute attacker-controlled commands. This issue has been patched in version 2.650.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
Required
User action required
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
webmin:webmin
References 4
https://github.com/webmin/webmin/commit/2d016751399ed0f4159e72a6cbcd63694a84dabf
security-advisories@github.com
https://github.com/webmin/webmin/releases/tag/2.650
security-advisories@github.com
https://github.com/webmin/webmin/security/advisories/GHSA-hv4w-p8jq-2rp5
security-advisories@github.com
https://beaksec.github.io/posts/webmin-one-click-rce-via-xss
security-advisories@github.com