CVE-2017-15646

State: Published
Severity: Not scored
Published: Oct 19, 2017
Updated: Sep 17, 2024
Reserved: Oct 19, 2017

Description

Webmin before 1.860 has XSS with resultant remote code execution. Under the 'Others/File Manager' menu, there is a 'Download from remote URL' option to download a file from a remote server. After setting up a malicious server, one can wait for a file download request and then send an XSS payload that will lead to Remote Code Execution, as demonstrated by an OS command in the value attribute of a name='cmd' input element.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

http://www.webmin.com/security.html
https://github.com/webmin/webmin/commit/0c58892732ee7610a7abba5507614366d382c9c9
https://blogs.securiteam.com/index.php/archives/3430
http://www.webmin.com/changes.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.