CVE-2023-41157 in Usermin
Summary
by MITRE • 09/16/2023
Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the folder name parameter while creating the folder to manage the folder tab, filter tab, and forward mail tab.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 02/01/2026
The vulnerability identified as CVE-2023-41157 represents a critical stored cross-site scripting flaw affecting Usermin version 2.000. This vulnerability resides within the web-based administration interface of Usermin, which is part of the larger webmin suite used for system administration through web interfaces. The flaw specifically manifests when users create folders within the management interface, particularly affecting parameters related to folder names that are subsequently displayed in various tabs including folder management, filter configuration, and mail forwarding functionalities. The stored nature of this vulnerability means that malicious scripts injected through folder names persist in the application's database and are executed whenever the affected pages are loaded by other users, creating a persistent threat vector.
The technical implementation of this vulnerability stems from inadequate input validation and output encoding within the Usermin application's folder creation and display mechanisms. When administrators or users create folders with maliciously crafted names containing script tags or other HTML content, the application fails to properly sanitize these inputs before storing them in its database. Subsequently, when these stored folder names appear in the various management tabs, the application does not adequately escape or encode the content for safe display, allowing the malicious scripts to execute within the context of other users' browsers. This vulnerability falls under the CWE-79 category of Cross-Site Scripting, specifically classified as a stored XSS variant where the malicious input is stored on the server and later executed without user interaction.
The operational impact of CVE-2023-41157 extends beyond simple script execution, as it provides attackers with the capability to perform various malicious activities within the victim's browser context. An attacker could potentially steal session cookies, redirect users to malicious websites, modify folder configurations, or even escalate privileges within the Usermin interface if the application lacks proper access controls. The vulnerability affects multiple tabs within the application, amplifying its potential impact since malicious payloads could be triggered across different functional areas of the system. This cross-tab persistence makes the vulnerability particularly dangerous as it increases the attack surface and the likelihood of successful exploitation, potentially allowing attackers to compromise user accounts and gain unauthorized access to system resources through the Usermin interface.
Mitigation strategies for CVE-2023-41157 should focus on immediate input validation and output encoding improvements within the Usermin application. Organizations should implement strict sanitization of all user-supplied input, particularly for folder names and other parameters that are subsequently displayed in web interfaces. The application should employ proper HTML escaping mechanisms when rendering stored folder names in the various management tabs to prevent script execution. Additionally, administrators should apply the latest security patches provided by the vendor, as this vulnerability has been addressed in subsequent releases of Usermin. Network-level protections such as web application firewalls can provide additional defense-in-depth measures, while regular security audits of web applications should include testing for stored XSS vulnerabilities in all input fields that are stored and later displayed. The ATT&CK framework categorizes this vulnerability under T1566.001 for initial access through malicious inputs, and T1059.001 for command and control through script execution, highlighting the multi-stage nature of potential exploitation.