Unscored severity · published Jan 5, 2010
CVE-2009-4568
Cross-site scripting (XSS) vulnerability in Webmin before 1.500 and Usermin before 1.430 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
–
CVSS
1.6%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Webmin before 1.500 and Usermin before 1.430 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
US
Usermin · Webmin
through 1.32; 0.4; 0.5; 0.6; 0.7; 0.8; +34 more · source: NVD
WE
Webmin · Webmin
through 1.390; 0.1; 0.2; 0.3; 0.4; 0.5; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-4568
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-4568
Vendor Advisory
http://secunia.com/advisories/37648
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDVSA-2010:036
Patch
http://www.securityfocus.com/bid/37259
Patch
http://www.vupen.com/english/advisories/2009/3457
Patch
http://www.webmin.com/security.html
More from Usermin
8.8
CVE-2015-2079
Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form of Perl open
8.8
CVE-2022-35132
Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module
6.1
CVE-2024-36453
Cross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions prior to 1.820
6.1
CVE-2023-41162
A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the file mask…
6.1
CVE-2022-36880
The Read Mail module in Webmin 1.995 and Usermin through 1.850 allows XSS via a crafted HTML e-mail message