Description
Cross-site scripting (XSS) vulnerability in Webmin 1.540 and earlier allows local users to inject arbitrary web script or HTML via a chfn command that changes the real (aka Full Name) field, related to useradmin/index.cgi and useradmin/user-lib.pl.
References
- [oss-security] 20110524 Re: CVE Request: Webmin Local Privilege Escalation Vulnerability mailing-list
- http://www.youtube.com/watch?v=CUO7JLIGUf0
- 1025438 vdb-entry
- 20110424 XSS in Webmin 1.540 + exploit for privilege escalation mailing-list
- https://github.com/webmin/webmin/commit/46e3d3ad195dcdc1af1795c96b6e0dc778fb6881
- [oss-security] 20110522 CVE Request: Webmin Local Privilege Escalation Vulnerability mailing-list
- MDVSA-2011:109 vendor-advisory
- 8264 third-party-advisory
- http://javierb.com.ar/2011/04/24/xss-webmin-1-540/
- 47558 vdb-entry