Medium severity · published Nov 1, 2023
CVE-2023-47099
A Stored Cross-Site Scripting (XSS) vulnerability in the Create Virtual Server in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via Description…
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
A Stored Cross-Site Scripting (XSS) vulnerability in the Create Virtual Server in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via Description field while creating the Virtual server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VI
Virtualmin · Virtualmin
7.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-47099
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-47099
Exploit
https://github.com/pavanughade43/Virtualmin-7.7/blob/main/CVE-2023-47099
More from Virtualmin
7.5
CVE-2024-45692
Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000
6.1
CVE-2018-18208
Virtualmin 6.03 allows XSS via the query string, as demonstrated by the webmin_search.cgi URI
6.1
CVE-2018-18207
Virtualmin 6.03 allows Frame Injection via the settings-editor_read.cgi file parameter
5.4
CVE-2023-47097
A Stored Cross-Site Scripting (XSS) vulnerability in the Server Template under System Setting in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via…
5.4
CVE-2023-47096
A Reflected Cross-Site Scripting (XSS) vulnerability in the Cloudmin Services Client under System Setting in Virtualmin 7.7 allows remote attackers to inject arbitrary web script…