Security readout for executives and security teams
Plain-English summary
CVE-2023-40984 is a reflected XSS issue reported in Webmin v2.100’s File Manager. A crafted value in the Replace in Results file can cause malicious script execution in a user’s browser. Business risk depends on who can reach that Webmin function and whether administrators could be tricked into opening attacker-controlled input.
Executive priority
Handle as a targeted administrative-interface risk. Prioritize internet-exposed or broadly accessible Webmin deployments, especially where privileged users manage systems through the File Manager.
Technical view
The public description identifies reflected cross-site scripting in Webmin v2.100 File Manager, specifically the Replace in Results file path. The bundle does not provide CVSS, CWE, authentication requirements, patch details, or vendor-confirmed affected ranges beyond the title and description.
Likely exposure
Organizations are likely exposed only where Webmin v2.100 is deployed and the File Manager Replace in Results functionality is reachable. The provided sources do not confirm broader version ranges, default exposure, or whether authentication is required.
Exploitation context
The source bundle states malicious script execution is possible through crafted input. It does not show CISA KEV listing, active exploitation, exploit maturity, or real-world campaign evidence. Treat exploitation status as unconfirmed.
Researcher notes
Evidence is sparse. The CVE record and reference identify the vulnerable function and input location, but omit scoring, root cause, authentication context, patch status, and complete affected versions. Avoid extending impact beyond reflected XSS without vendor confirmation.
Mitigation direction
- Check Webmin vendor guidance for confirmed fixed versions or workarounds.
- Upgrade Webmin if vendor guidance identifies a fixed release.
- Restrict Webmin access to trusted administrators and trusted networks.
- Limit or disable File Manager access where operationally feasible.
- Monitor for suspicious Webmin requests containing script-like input.
Validation and detection
- Inventory Webmin instances and confirm whether v2.100 is present.
- Verify who can access the File Manager feature.
- Review Webmin and reverse-proxy logs for suspicious Replace in Results requests.
- Confirm whether vendor advisories mention CVE-2023-40984 or related XSS fixes.
- Use authorized, benign testing to verify user input is safely encoded.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-40984 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/Vi39/Webmin-2.100/blob/main/CVE-2023-40984CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.