CVE-2017-9313 - Vulnerability Details - OpenCVE

Multiple Cross-site scripting (XSS) vulnerabilities in Webmin before 1.850 allow remote attackers to inject arbitrary web script or HTML via the sec parameter to view_man.cgi, the referers parameter to change_referers.cgi, or the name parameter to save_user.cgi. NOTE: these issues were not fixed in 1.840.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Webmin	Webmin

Configuration 1 [-]

cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://seclists.org/bugtraq/2017/Jul/3
http://www.securityfocus.com/bid/99373
http://www.securitytracker.com/id/1038814
http://www.webmin.com/changes.html
https://github.com/webmin/webmin/commit/a330e913ee099cb9c586ce1b9267647fc566c1ab
https://github.com/webmin/webmin/commit/c2d4a90639afb2403979aa91ba75cb332ae16d1b

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2017-07-04T02:00:00

Updated: 2024-08-05T17:02:44.374Z

Reserved: 2017-05-30T00:00:00

Link: CVE-2017-9313

Vulnrichment

No data.

NVD

Status : Modified

Published: 2017-07-04T02:29:00.283

Modified: 2024-11-21T03:35:48.980

Link: CVE-2017-9313

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2017-07-03T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple Cross-site scripting (XSS) vulnerabilities in Webmin before 1.850 allow remote attackers to inject arbitrary web script or HTML via the sec parameter to view_man.cgi, the referers parameter to change_referers.cgi, or the name parameter to save_user.cgi. NOTE: these issues were not fixed in 1.840."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-06T09:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/webmin/webmin/commit/a330e913ee099cb9c586ce1b9267647fc566c1ab"}, {"tags": ["x_refsource_MISC"], "url": "http://seclists.org/bugtraq/2017/Jul/3"}, {"name": "1038814", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1038814"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/webmin/webmin/commit/c2d4a90639afb2403979aa91ba75cb332ae16d1b"}, {"name": "99373", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/99373"}, {"tags": ["x_refsource_MISC"], "url": "http://www.webmin.com/changes.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-9313", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple Cross-site scripting (XSS) vulnerabilities in Webmin before 1.850 allow remote attackers to inject arbitrary web script or HTML via the sec parameter to view_man.cgi, the referers parameter to change_referers.cgi, or the name parameter to save_user.cgi. NOTE: these issues were not fixed in 1.840."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/webmin/webmin/commit/a330e913ee099cb9c586ce1b9267647fc566c1ab", "refsource": "MISC", "url": "https://github.com/webmin/webmin/commit/a330e913ee099cb9c586ce1b9267647fc566c1ab"}, {"name": "http://seclists.org/bugtraq/2017/Jul/3", "refsource": "MISC", "url": "http://seclists.org/bugtraq/2017/Jul/3"}, {"name": "1038814", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1038814"}, {"name": "https://github.com/webmin/webmin/commit/c2d4a90639afb2403979aa91ba75cb332ae16d1b", "refsource": "MISC", "url": "https://github.com/webmin/webmin/commit/c2d4a90639afb2403979aa91ba75cb332ae16d1b"}, {"name": "99373", "refsource": "BID", "url": "http://www.securityfocus.com/bid/99373"}, {"name": "http://www.webmin.com/changes.html", "refsource": "MISC", "url": "http://www.webmin.com/changes.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T17:02:44.374Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/webmin/webmin/commit/a330e913ee099cb9c586ce1b9267647fc566c1ab"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://seclists.org/bugtraq/2017/Jul/3"}, {"name": "1038814", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1038814"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/webmin/webmin/commit/c2d4a90639afb2403979aa91ba75cb332ae16d1b"}, {"name": "99373", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/99373"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.webmin.com/changes.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-9313", "datePublished": "2017-07-04T02:00:00", "dateReserved": "2017-05-30T00:00:00", "dateUpdated": "2024-08-05T17:02:44.374Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*", "matchCriteriaId": "84CBDEDB-2FA2-47C2-BC5C-8AAFBC2ECAB7", "versionEndIncluding": "1.840", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Multiple Cross-site scripting (XSS) vulnerabilities in Webmin before 1.850 allow remote attackers to inject arbitrary web script or HTML via the sec parameter to view_man.cgi, the referers parameter to change_referers.cgi, or the name parameter to save_user.cgi. NOTE: these issues were not fixed in 1.840."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de tipo cross-site-scripting (XSS) en Webmin anterior a la versi\u00f3n 1.850, permiten a los atacantes remotos inyectar script web o HTML arbitrario por medio del par\u00e1metro sec en el archivo view_man.cgi, el par\u00e1metro referers en el archivo change_referers.cgi, o el par\u00e1metro name en el archivo save_user.cgi. NOTA: estos problemas no fueron corregidos en la versi\u00f3n 1.840."}], "id": "CVE-2017-9313", "lastModified": "2024-11-21T03:35:48.980", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-07-04T02:29:00.283", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "http://seclists.org/bugtraq/2017/Jul/3"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/99373"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1038814"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Vendor Advisory"], "url": "http://www.webmin.com/changes.html"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/webmin/webmin/commit/a330e913ee099cb9c586ce1b9267647fc566c1ab"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/webmin/webmin/commit/c2d4a90639afb2403979aa91ba75cb332ae16d1b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "http://seclists.org/bugtraq/2017/Jul/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/99373"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1038814"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "http://www.webmin.com/changes.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/webmin/webmin/commit/a330e913ee099cb9c586ce1b9267647fc566c1ab"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/webmin/webmin/commit/c2d4a90639afb2403979aa91ba75cb332ae16d1b"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}