Medium severity · published Nov 1, 2023
CVE-2023-47098
A Stored Cross-Site Scripting (XSS) vulnerability in the Manage Extra Admins under Administration Options in Virtualmin 7.7 allows remote attackers to inject arbitrary web script…
4.8
CVSS
0.5%
EPSS
No
On KEV
Description
A Stored Cross-Site Scripting (XSS) vulnerability in the Manage Extra Admins under Administration Options in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the real name or description field.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VI
Virtualmin · Virtualmin
7.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-47098
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-47098
Exploit
https://github.com/pavanughade43/Virtualmin-7.7/blob/main/CVE-2023-47098
More from Virtualmin
7.5
CVE-2024-45692
Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000
6.1
CVE-2018-18208
Virtualmin 6.03 allows XSS via the query string, as demonstrated by the webmin_search.cgi URI
6.1
CVE-2018-18207
Virtualmin 6.03 allows Frame Injection via the settings-editor_read.cgi file parameter
5.4
CVE-2023-47099
A Stored Cross-Site Scripting (XSS) vulnerability in the Create Virtual Server in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via Description…
5.4
CVE-2023-47097
A Stored Cross-Site Scripting (XSS) vulnerability in the Server Template under System Setting in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via…