In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mailman | May 4, 2022 | Dec 2, 2021 |
| Amazon Linux Ami 2 | — | Upgrade mailmanUpgrade mailman-debuginfo | Jul 4, 2022 | Dec 2, 2021 |
| Centos_linux | — | Upgrade mailmanUpgrade mailman-debugsourceUpgrade mailman-debuginfo | Dec 3, 2021 | Dec 2, 2021 |
| Debian | — | Upgrade mailman | Jun 10, 2022 | Dec 2, 2021 |
| Freebsd | — | Upgrade mailman-with-htdigUpgrade mailmanUpgrade mailman-exim4-with-htdigUpgrade mailman-exim4Upgrade mailman-postfixUpgrade mailman-postfix-with-htdig | Nov 4, 2022 | Dec 1, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade mailman | May 25, 2022 | Dec 2, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade mailman | Mar 2, 2022 | Dec 2, 2021 |
| Oracle Solaris | — | Upgrade mail/mailman to version 2.1.33-11.4.41.0.1.107.2 on Solaris 11.4 | Jan 19, 2022 | Dec 2, 2021 |
| Oracle_linux | — | Upgrade mailman | Dec 3, 2021 | Nov 26, 2021 |
| Redhat_linux | — | No solution existsUpgrade mailman-debuginfoUpgrade mailman-debugsourceUpgrade mailman | Dec 3, 2021 | Dec 2, 2021 |
| Rocky_linux | — | Upgrade mailman-debuginfoUpgrade mailman-debugsourceUpgrade mailman | Mar 12, 2024 | Dec 2, 2021 |
| Suse | — | Upgrade mailman | Oct 26, 2022 | Dec 2, 2021 |
| Ubuntu | — | Upgrade mailman (Ubuntu Pro)Upgrade mailman | Dec 8, 2021 | Dec 2, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub