Executive Summary

Informations
NameCVE-2011-1937First vendor Publication2011-05-31
VendorCveLast vendor Modification2011-09-21

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score4.3Attack RangeNetwork
Cvss Impact Score2.9Attack ComplexityMedium
Cvss Expoit Score8.6AuthentificationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

Cross-site scripting (XSS) vulnerability in Webmin 1.540 and earlier allows local users to inject arbitrary web script or HTML via a chfn command that changes the real (aka Full Name) field, related to useradmin/index.cgi and useradmin/user-lib.pl.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1937

CWE : Common Weakness Enumeration

idName
CWE-79Failure to Preserve Web Page Structure ('Cross-site Scripting')

CPE : Common Platform Enumeration

TypeDescriptionCount
Application79

Open Source Vulnerability Database (OSVDB)

idDescription
74342Webmin useradmin/user-lib.pl chfn Command Full Name Field XSS

Internal Sources (Detail)

SourceUrl
BIDhttp://www.securityfocus.com/bid/47558
BUGTRAQhttp://www.securityfocus.com/archive/1/517658
CONFIRMhttps://github.com/webmin/webmin/commit/46e3d3ad195dcdc1af1795c96b6e0dc778fb6881
MANDRIVAhttp://www.mandriva.com/security/advisories?name=MDVSA-2011:109
MISChttp://javierb.com.ar/2011/04/24/xss-webmin-1-540/
http://www.youtube.com/watch?v=CUO7JLIGUf0
MLISThttp://openwall.com/lists/oss-security/2011/05/22/1
http://openwall.com/lists/oss-security/2011/05/24/7
SECTRACKhttp://securitytracker.com/id?1025438
SREASONhttp://securityreason.com/securityalert/8264

Alert History

If you want to see full details history, please login or register.
0
DateInformations
2013-05-10 23:00:43
  • Multiple Updates