CVEvulnerability
CVE-2017-9313
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2017-07-04
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.1 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple Cross-site scripting (XSS) vulnerabilities in Webmin before 1.850 allow remote attackers to inject arbitrary web script or HTML via the sec parameter to view_man.cgi, the referers parameter to change_referers.cgi, or the name parameter to save_user.cgi. NOTE: these issues were not fixed in 1.840.
Affected configurations
• webmin webmin (<= 1.840)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://seclists.org/bugtraq/2017/Jul/3 Exploit, Third Party Advisory
- http://www.securityfocus.com/bid/99373 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038814 Third Party Advisory, VDB Entry
- http://www.webmin.com/changes.html Release Notes, Vendor Advisory
- https://github.com/webmin/webmin/commit/a330e913ee099cb9c586ce1b9267647fc566c1ab Patch, Third Party Advisory
- https://github.com/webmin/webmin/commit/c2d4a90639afb2403979aa91ba75cb332ae16d1b Patch, Third Party Advisory
- http://seclists.org/bugtraq/2017/Jul/3 Exploit, Third Party Advisory
- http://www.securityfocus.com/bid/99373 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038814 Third Party Advisory, VDB Entry
- http://www.webmin.com/changes.html Release Notes, Vendor Advisory
- https://github.com/webmin/webmin/commit/a330e913ee099cb9c586ce1b9267647fc566c1ab Patch, Third Party Advisory
- https://github.com/webmin/webmin/commit/c2d4a90639afb2403979aa91ba75cb332ae16d1b Patch, Third Party Advisory