CVE-2023-40986
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A stored XSS vulnerability was found in Webmin v2.100 in the Usermin Configuration function. Attackers can inject malicious JavaScript or HTML into the Custom field, leading to script execution in the victim's browser.
Risk Assessment
The risk includes session hijacking, account takeover, or unauthorized actions performed on behalf of the victim. This could be used to spread malware or steal sensitive data.
Recommendation
Immediately update Webmin to the latest patched version. Additionally, restrict access to the admin panel and implement input validation.
Original NVD description (English source)
A stored cross-site scripting (XSS) vulnerability in the Usermin Configuration function of Webmin v2.100 allows attackers to execute arbitrary web sripts or HTML via a crafted payload injected into the Custom field.