Webmin 'real name' Field Cross Site Scripting Vulnerability
BID:56387
Info
Webmin 'real name' Field Cross Site Scripting Vulnerability
| Bugtraq ID: | 56387 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 05 2012 12:00AM |
| Updated: | Nov 05 2012 12:00AM |
| Credit: | Reported by vendor. |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Webmin 'real name' Field Cross Site Scripting Vulnerability
Webmin is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Webmin 1.600 is vulnerable; prior versions may also be affected.
Webmin is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Webmin 1.600 is vulnerable; prior versions may also be affected.
Exploit / POC
Webmin 'real name' Field Cross Site Scripting Vulnerability
Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.