National Cyber Awareness System

Vulnerability Summary for CVE-2011-1937

Overview

Cross-site scripting (XSS) vulnerability in Webmin 1.540 and earlier allows local users to inject arbitrary web script or HTML via a chfn command that changes the real (aka Full Name) field, related to useradmin/index.cgi and useradmin/user-lib.pl.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://github.com/webmin/webmin/commit/46e3d3ad195dcdc1af1795c96b6e0dc778fb6881

Type: Patch Information

Hyperlink:https://github.com/webmin/webmin/commit/46e3d3ad195dcdc1af1795c96b6e0dc778fb6881

External Source: MISC

Name: http://www.youtube.com/watch?v=CUO7JLIGUf0

Hyperlink:http://www.youtube.com/watch?v=CUO7JLIGUf0

External Source: BID

Name: 47558

Hyperlink:http://www.securityfocus.com/bid/47558

External Source: BUGTRAQ

Name: 20110424 XSS in Webmin 1.540 + exploit for privilege escalation

Hyperlink:http://www.securityfocus.com/archive/1/517658

External Source: MANDRIVA

Name: MDVSA-2011:109

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2011:109

External Source: SECTRACK

Name: 1025438

Hyperlink:http://securitytracker.com/id?1025438

External Source: SREASON

Name: 8264

Hyperlink:http://securityreason.com/securityalert/8264

External Source: MLIST

Name: [oss-security] 20110524 Re: CVE Request: Webmin Local Privilege Escalation Vulnerability

Hyperlink:http://openwall.com/lists/oss-security/2011/05/24/7

External Source: MLIST

Name: [oss-security] 20110522 CVE Request: Webmin Local Privilege Escalation Vulnerability

Hyperlink:http://openwall.com/lists/oss-security/2011/05/22/1

External Source: MISC

Name: http://javierb.com.ar/2011/04/24/xss-webmin-1-540/

Hyperlink:http://javierb.com.ar/2011/04/24/xss-webmin-1-540/