CVE-2008-0720 Cross-site scripting (XSS) vulnerability in Webmin 1.370 and 1.390 and Usermin 1.300 and 1.320 allows remote attackers to inject arbitrary web script or HTML via the search parameter to webmin_search....
MediumCVSS 4.3
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in Webmin 1.370 and 1.390 and Usermin 1.300 and 1.320 allows remote attackers to inject arbitrary web script or HTML via the search parameter to webmin_search.cgi (aka the search section), and possibly other components accessed through a "search box" or "open file box." NOTE: some of these details are obtained from third party information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| webmin/usermin | = 1.3 | No fix listed |
| webmin/usermin | = 1.32 | No fix listed |
| webmin | = 1.370 | No fix listed |
| webmin | = 1.390 | No fix listed |
References
- forum.aria-security.net
- 28827 third-party-advisory vendor-advisory
- 20080206 Tested on Webmin 1.390 mailing-list
- 20080206 Re: Tested on Webmin 1.390 mailing-list
- 27662 vdb-entry
- ADV-2008-0450 vdb-entry