CVE-2020-8820

Name of the Vulnerable Software and Affected Versions Webmin versions 1.941 and earlier

Description An issue exists where a user can enter any XSS payload into the Command field of the "Cluster Shell Commands" endpoint and execute it. Upon revisiting the Cluster Shell Commands Menu, the XSS payload will be rendered and executed.

Recommendations For Webmin versions 1.941 and earlier, consider disabling access to the Cluster Shell Commands endpoint until a fix is available. As a temporary workaround, restrict the ability to enter custom commands in the Command field to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.