CVE-2020-8821: 
Webmin vulnerability analysis and mitigation

An Improper Data Validation Vulnerability (CVE-2020-8821) was discovered in Webmin 1.941 and earlier, specifically affecting the Command Shell module. The vulnerability was disclosed on January 16, 2020, and involves an XSS (Cross-Site Scripting) vulnerability where users with privileges to create custom commands could potentially exploit other users through unescaped HTML code (Webmin Security, NVD).

The vulnerability exists in the Command Shell Endpoint of Webmin where HTML code input validation was improperly implemented. This allowed users with specific privileges to inject malicious HTML code that could be executed in the context of other users' sessions (NVD, FortiGuard).

The vulnerability could allow authenticated users with command creation privileges to perform cross-site scripting attacks against other Webmin users, potentially leading to session hijacking or unauthorized actions being performed in the context of the victim's session (Webmin Security).

The vulnerability requires an authenticated user with privileges to create custom commands in the Command Shell module. The exploit can be triggered when other users access the affected functionality where the malicious HTML code has been injected (NVD).

The vulnerability was addressed in versions after Webmin 1.941. Users are recommended to upgrade to a version newer than 1.941 to protect against this vulnerability (Webmin Security).