CVE-2023-40984

MediumCVSS 5.4

Published: 15/09/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.41%

33th percentile - higher than 33% of all known CVEs

Summary

A reflected cross-site scripting (XSS) vulnerability exists in the File Manager function of Webmin v2.100. It allows attackers to execute malicious scripts by injecting a crafted payload into the 'Replace in Results' file.

Risk Assessment

The risk involves potential session theft, account takeover, or unauthorized actions performed in the context of the victim's session, leading to data confidentiality and integrity breaches.

Recommendation

Immediately upgrade Webmin to a version newer than 2.100 that includes a fix for this vulnerability. Until the update, restrict access to the File Manager function to trusted users only.

Original NVD description (English source)

A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload into the Replace in Results file.