CVE-2023-38307: 
Webmin vulnerability analysis and mitigation

An issue was discovered in Webmin 2.021, where a Stored Cross-Site Scripting (XSS) vulnerability was identified in the Users and Groups functionality. The vulnerability occurs when an authenticated user adds a new user and inserts an XSS payload into the user's real name (GitHub Exploit, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The vulnerability specifically affects the user's real name field in the Users and Groups functionality (NVD).

If successfully exploited, this vulnerability allows attackers to execute arbitrary web scripts or HTML within the context of the victim's browser when the affected user account is accessed. This could potentially lead to unauthorized access to sensitive information or manipulation of the web interface (GitHub Exploit).

The vulnerability requires authentication and can be exploited by inserting a malicious XSS payload into the real name field when creating a new user. The attack becomes active when attempting to delete the created user (GitHub Exploit).

Users should upgrade to a version newer than Webmin 2.021. The vulnerability has been addressed in subsequent releases (Webmin Changelog).