Virtualmin Multiple Security Vulnerabilities
BID:43587
Info
Virtualmin Multiple Security Vulnerabilities
| Bugtraq ID: | 43587 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Jul 04 2009 12:00AM |
| Updated: | Jul 04 2009 12:00AM |
| Credit: | Filip Palian |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Virtualmin Multiple Security Vulnerabilities
Virtualmin is prone to multiple security vulnerabilities. These vulnerabilities include multiple cross-site scripting vulnerabilities, a local information-disclosure vulnerability, and a local privilege-escalation vulnerability.
Local attackers may exploit these issues to obtain sensitive information or gain elevated privileges on the affected computer. Remote attackers may exploit these issues to steal cookie-based authentication information, and execute arbitrary client-side scripts in the context of the browser.
Versions prior to Virtualmin 2.7.0 are vulnerable.
Virtualmin is prone to multiple security vulnerabilities. These vulnerabilities include multiple cross-site scripting vulnerabilities, a local information-disclosure vulnerability, and a local privilege-escalation vulnerability.
Local attackers may exploit these issues to obtain sensitive information or gain elevated privileges on the affected computer. Remote attackers may exploit these issues to steal cookie-based authentication information, and execute arbitrary client-side scripts in the context of the browser.
Versions prior to Virtualmin 2.7.0 are vulnerable.
Exploit / POC
Virtualmin Multiple Security Vulnerabilities
An attacker uses readily available commands to exploit the local information-disclosure and privilege-escalation issues. To exploit a cross-site scripting issue, attackers must entice an unsuspecting user to follow a malicious URI.
The following example URIs are available:
An attacker uses readily available commands to exploit the local information-disclosure and privilege-escalation issues. To exploit a cross-site scripting issue, attackers must entice an unsuspecting user to follow a malicious URI.
The following example URIs are available:
Solution / Fix
Virtualmin Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Virtualmin Multiple Security Vulnerabilities
References:
References:
- Virtualmin Homepage (Virtualmin)
- Virtualmin plugins updates (security) (Virtualmin)
- Virtualmin virtual-server module 3.70 (security) (Virtualmin)