Medium severity · published Aug 30, 2023
CVE-2023-41163
A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the replace in…
6.1
CVSS
0.5%
EPSS
No
On KEV
Description
A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the replace in results field while replacing the results under the tools drop down.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Webmin · Webmin
2.000 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-41163
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-41163
Third Party Advisory
https://github.com/shindeanik/Usermin-2.000/blob/main/CVE-2023-41163
Release Notes
https://webmin.com/tags/webmin-changelog/
More from Webmin
9.8
CVE-2019-15107
Webmin Command Injection Vulnerability
9.8
CVE-2022-36446
software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command
9.8
CVE-2020-35769
miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program
9.8
CVE-2018-8712
An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled
9.6
CVE-2026-49243
Webmin: Reflected XSS in the Configuration module