CVE-2021-31761 - Vulnerability Details - OpenCVE

Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process feature.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Webmin	Webmin

Configuration 1 [-]

cpe:2.3:a:webmin:webmin:1.973:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://packetstormsecurity.com/files/163559/Webmin-1.973-Cross-Site-Request-Forgery.html
https://github.com/Mesh3l911/CVE-2021-31761
https://github.com/electronicbots/CVE-2021-31761
https://github.com/webmin/webmin
https://youtu.be/23VvUMu-28c

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2021-04-25T18:30:40

Updated: 2024-08-03T23:03:33.750Z

Reserved: 2021-04-23T00:00:00

Link: CVE-2021-31761

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-04-25T19:15:08.207

Modified: 2024-11-21T06:06:11.657

Link: CVE-2021-31761

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process feature."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-07-20T15:06:11", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/webmin/webmin"}, {"tags": ["x_refsource_MISC"], "url": "https://youtu.be/23VvUMu-28c"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/Mesh3l911/CVE-2021-31761"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/electronicbots/CVE-2021-31761"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/163559/Webmin-1.973-Cross-Site-Request-Forgery.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2021-31761", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process feature."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/webmin/webmin", "refsource": "MISC", "url": "https://github.com/webmin/webmin"}, {"name": "https://youtu.be/23VvUMu-28c", "refsource": "MISC", "url": "https://youtu.be/23VvUMu-28c"}, {"name": "https://github.com/Mesh3l911/CVE-2021-31761", "refsource": "MISC", "url": "https://github.com/Mesh3l911/CVE-2021-31761"}, {"name": "https://github.com/electronicbots/CVE-2021-31761", "refsource": "MISC", "url": "https://github.com/electronicbots/CVE-2021-31761"}, {"name": "http://packetstormsecurity.com/files/163559/Webmin-1.973-Cross-Site-Request-Forgery.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/163559/Webmin-1.973-Cross-Site-Request-Forgery.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T23:03:33.750Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/webmin/webmin"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://youtu.be/23VvUMu-28c"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Mesh3l911/CVE-2021-31761"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/electronicbots/CVE-2021-31761"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/163559/Webmin-1.973-Cross-Site-Request-Forgery.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2021-31761", "datePublished": "2021-04-25T18:30:40", "dateReserved": "2021-04-23T00:00:00", "dateUpdated": "2024-08-03T23:03:33.750Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:webmin:webmin:1.973:*:*:*:*:*:*:*", "matchCriteriaId": "36AF9E26-A663-4BCE-AD76-CABD6DA36B66", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process feature."}, {"lang": "es", "value": "Webmin versi\u00f3n 1.973, esta afectado por una vulnerabilidad de tipo Cross Site Scripting (XSS) reflejado para lograr una ejecuci\u00f3n de comandos remota por medio de la funcionalidad Webmin's running process"}], "id": "CVE-2021-31761", "lastModified": "2024-11-21T06:06:11.657", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-04-25T19:15:08.207", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/163559/Webmin-1.973-Cross-Site-Request-Forgery.html"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/Mesh3l911/CVE-2021-31761"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/electronicbots/CVE-2021-31761"}, {"source": "cve@mitre.org", "tags": ["Product", "Third Party Advisory"], "url": "https://github.com/webmin/webmin"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://youtu.be/23VvUMu-28c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/163559/Webmin-1.973-Cross-Site-Request-Forgery.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/Mesh3l911/CVE-2021-31761"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/electronicbots/CVE-2021-31761"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product", "Third Party Advisory"], "url": "https://github.com/webmin/webmin"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://youtu.be/23VvUMu-28c"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}