Stay Secure with the Latest Linux Advisories

security advisoryxsswebmin

Mageia 7: MGASA-2020-0400 Moderate: Webmin XSS and Input Issues

An XSS Vulnerability exists in Webmin 1.941 and earlier affecting the Cluster Shell Commands Endpoint. A user may enter any XSS Payload into the Command field and execute it. Then, after revisiting the Cluster Shell Commands Menu, the XSS Payload will be rendered and executed. (CVE-2020-8820) . MGASA-2020-0400 - Updated webmin package fixes security vulnerabilities Publication date: 08 Nov 2020 URL: https://advisories.mageia.org/MGASA-2020-0400.html Type: security Affected Mageia releases: 7 CVE: CVE-2020-8820, CVE-2020-8821, CVE-2020-12670 An XSS Vulnerability exists in Webmin 1.941 and earlier affecting the Cluster Shell Commands Endpoint. A user may enter any XSS Payload into the Command field and execute it. Then, after revisiting the Cluster Shell Commands Menu, the XSS Payload will be rendered and executed. (CVE-2020-8820) An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting the Command Shell Endpoint. A user may enter HTML code into the Command field and submit it. Then, after visiting the Action Logs Menu and displaying logs, the HTML code will be rendered (however, JavaScript is not executed). Changes are kept across users. (CVE-2020-8821) XSS exists in Webmin 1.941 and earlier affecting the Save function of the Read User Email Module / mailboxes Endpoint when attempting to save HTML emails. This module parses any output without sanitizing SCRIPT elements, as opposed to the View function, which sanitizes the input correctly. A malicious user can send any JavaScript payload into the message body and execute it if the user decides to save that email. (CVE-2020-12670) References: - https://bugs.mageia.org/show_bug.cgi?id=27459 - https://webmin.com/security/ - https://webmin.com/tags/webmin-changelog/ - https://www.cve.org/CVERecord?id=CVE-2020-8820 - https://www.cve.org/CVERecord?id=CVE-2020-8821 - https://www.cve.org/CVERecord?id=CVE-2020-12670 SRPMS: - 7/core/webmin-1.960-1.mga7 . MGASA-2020-0500 highlights vulnerabilities in Webminconcerning XSS and deficient input validation on Mageia 8 version. Urgent update suggested!. XSS Exploits, Webmin Security, Mageia Update, Command Shell Vulnerability. . LinuxSecurity.com Team

Nov 08, 2020 Mageia