fkie_cve-2017-15646
Vulnerability from fkie_nvd
Published
2017-10-19 22:29
Modified
2024-11-21 03:14
Severity ?
6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Webmin before 1.860 has XSS with resultant remote code execution. Under the 'Others/File Manager' menu, there is a 'Download from remote URL' option to download a file from a remote server. After setting up a malicious server, one can wait for a file download request and then send an XSS payload that will lead to Remote Code Execution, as demonstrated by an OS command in the value attribute of a name='cmd' input element.
References
cve@mitre.orghttp://www.webmin.com/changes.htmlRelease Notes, Vendor Advisory
cve@mitre.orghttp://www.webmin.com/security.htmlVendor Advisory
cve@mitre.orghttps://blogs.securiteam.com/index.php/archives/3430Exploit, Third Party Advisory
cve@mitre.orghttps://github.com/webmin/webmin/commit/0c58892732ee7610a7abba5507614366d382c9c9Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.webmin.com/changes.htmlRelease Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.webmin.com/security.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://blogs.securiteam.com/index.php/archives/3430Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/webmin/webmin/commit/0c58892732ee7610a7abba5507614366d382c9c9Patch, Third Party Advisory
Impacted products
Vendor Product Version
webmin webmin *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "A946EA8C-A37B-497C-96F0-68F5AD312139",
                     versionEndIncluding: "1.850",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Webmin before 1.860 has XSS with resultant remote code execution. Under the 'Others/File Manager' menu, there is a 'Download from remote URL' option to download a file from a remote server. After setting up a malicious server, one can wait for a file download request and then send an XSS payload that will lead to Remote Code Execution, as demonstrated by an OS command in the value attribute of a name='cmd' input element.",
      },
      {
         lang: "es",
         value: "Webmin, en versiones anteriores a la 1.860, tiene XSS que puede resultar en la ejecución remota de código. En el menú \"Others/File Manager\", hay una opción \"Download from remote URL\" (descarga desde URL remota) para descargar un archivo desde un servidor remoto. Después de establecer un servidor malicioso, el atacante puede esperar una petición de descarga de archivo y entonces enviar un payload XSS que dará lugar a la ejecución remota de código. Esto ha sido demostrado por un comando de sistema operativo en el atributo valor de un elemento de entrada name='cmd'.",
      },
   ],
   id: "CVE-2017-15646",
   lastModified: "2024-11-21T03:14:56.730",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.1,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "NONE",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 2.7,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-10-19T22:29:00.323",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "http://www.webmin.com/changes.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://www.webmin.com/security.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Exploit",
            "Third Party Advisory",
         ],
         url: "https://blogs.securiteam.com/index.php/archives/3430",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/webmin/webmin/commit/0c58892732ee7610a7abba5507614366d382c9c9",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "http://www.webmin.com/changes.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://www.webmin.com/security.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Third Party Advisory",
         ],
         url: "https://blogs.securiteam.com/index.php/archives/3430",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/webmin/webmin/commit/0c58892732ee7610a7abba5507614366d382c9c9",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.