CVE-2017-15646

{"id": "CVE-2017-15646", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2017-10-19T22:29:00.323", "references": [{"url": "http://www.webmin.com/changes.html", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.webmin.com/security.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://blogs.securiteam.com/index.php/archives/3430", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/webmin/webmin/commit/0c58892732ee7610a7abba5507614366d382c9c9", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Webmin before 1.860 has XSS with resultant remote code execution. Under the 'Others/File Manager' menu, there is a 'Download from remote URL' option to download a file from a remote server. After setting up a malicious server, one can wait for a file download request and then send an XSS payload that will lead to Remote Code Execution, as demonstrated by an OS command in the value attribute of a name='cmd' input element."}, {"lang": "es", "value": "Webmin, en versiones anteriores a la 1.860, tiene XSS que puede resultar en la ejecuci\u00f3n remota de c\u00f3digo. En el men\u00fa \"Others/File Manager\", hay una opci\u00f3n \"Download from remote URL\" (descarga desde URL remota) para descargar un archivo desde un servidor remoto. Despu\u00e9s de establecer un servidor malicioso, el atacante puede esperar una petici\u00f3n de descarga de archivo y entonces enviar un payload XSS que dar\u00e1 lugar a la ejecuci\u00f3n remota de c\u00f3digo. Esto ha sido demostrado por un comando de sistema operativo en el atributo valor de un elemento de entrada name='cmd'."}], "lastModified": "2017-11-08T18:19:11.117", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A946EA8C-A37B-497C-96F0-68F5AD312139", "versionEndIncluding": "1.850"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}