Medium severity · published Nov 1, 2023
CVE-2023-47094
A Stored Cross-Site Scripting (XSS) vulnerability in the Account Plans tab of System Settings in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via…
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
A Stored Cross-Site Scripting (XSS) vulnerability in the Account Plans tab of System Settings in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Plan name field while editing Account plan details.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VI
Virtualmin · Virtualmin
7.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-47094
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-47094
Exploit
https://github.com/pavanughade43/Virtualmin-7.7/blob/main/CVE-2023-47094
More from Virtualmin
7.5
CVE-2024-45692
Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000
6.1
CVE-2018-18208
Virtualmin 6.03 allows XSS via the query string, as demonstrated by the webmin_search.cgi URI
6.1
CVE-2018-18207
Virtualmin 6.03 allows Frame Injection via the settings-editor_read.cgi file parameter
5.4
CVE-2023-47099
A Stored Cross-Site Scripting (XSS) vulnerability in the Create Virtual Server in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via Description…
5.4
CVE-2023-47097
A Stored Cross-Site Scripting (XSS) vulnerability in the Server Template under System Setting in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via…