PT-2020-20303 · Webmin · Webmin

Mauro Caseres · Published 2020-10-12 · Updated 2020-11-08 · CVE-2020-8820

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Webmin versions 1.941 and earlier

Description An issue exists where a user can enter any XSS payload into the Command field of the "Cluster Shell Commands" endpoint and execute it. Upon revisiting the Cluster Shell Commands Menu, the XSS payload will be rendered and executed.

Recommendations For Webmin versions 1.941 and earlier, consider disabling access to the Cluster Shell Commands endpoint until a fix is available. As a temporary workaround, restrict the ability to enter custom commands in the Command field to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-8820

MGASA-2020-0400

Affected Products

Webmin

References · 8

• https://osv.dev/vulnerability/CVE-2020-8820 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0400.html · Security Note
• https://webmin.com/security.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0400 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8820 · Security Note
• https://bugs.mageia.org/show_bug.cgi?id=27459 · Note
• https://webmin.com/changes.html · Note
• https://t.me/cibsecurity/15208 · Telegram Post