PatchTheCVEvirtualmin vulnerabilities
Recent CVEs affecting virtualmin products. 7 tracked.
virtualmin has 7 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2024-09-04. Highest priority: CVE-2024-45692 (score 44/100).
- CVE-2024-45692 HIGH 7.5 UPGRADE UPGRADE Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port
- CVE-2023-47099 MEDIUM 5.4 DOWNGRADE A Stored Cross-Site Scripting (XSS) vulnerability in the Create Virtual Server in Virtualmin 7.7 allows remote
- CVE-2023-47098 MEDIUM 4.8 DOWNGRADE A Stored Cross-Site Scripting (XSS) vulnerability in the Manage Extra Admins under Administration Options in V
- CVE-2023-47097 MEDIUM 5.4 DOWNGRADE A Stored Cross-Site Scripting (XSS) vulnerability in the Server Template under System Setting in Virtualmin 7.
- CVE-2023-47096 MEDIUM 5.4 DOWNGRADE A Reflected Cross-Site Scripting (XSS) vulnerability in the Cloudmin Services Client under System Setting in V
- CVE-2023-47095 MEDIUM 5.4 DOWNGRADE A Stored Cross-Site Scripting (XSS) vulnerability in the Custom fields of Edit Virtual Server under System Cus
- CVE-2023-47094 MEDIUM 5.4 DOWNGRADE A Stored Cross-Site Scripting (XSS) vulnerability in the Account Plans tab of System Settings in Virtualmin 7.
FAQ
How do I fix virtualmin vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is virtualmin being exploited right now?
None of the tracked virtualmin CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which virtualmin CVE should I patch first?
CVE-2024-45692 currently ranks highest (44/100): Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port .