vulnerability
FreeBSD: VID-9D7A2B54-4468-11EC-8532-0D24C37C72C8 (CVE-2021-43332): mailman -- 2.1.37 fixes XSS via user options, and moderator offline brute-force vuln against list admin password
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 4 | (AV:N/AC:L/Au:S/C:P/I:N/A:N) | 2021-11-01 | 2022-11-04 | 2022-11-04 |
Severity
4
CVSS
(AV:N/AC:L/Au:S/C:P/I:N/A:N)
Published
2021-11-01
Added
2022-11-04
Modified
2022-11-04
Description
In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack.
Solution(s)
freebsd-upgrade-package-mailmanfreebsd-upgrade-package-mailman-exim4freebsd-upgrade-package-mailman-exim4-with-htdigfreebsd-upgrade-package-mailman-postfixfreebsd-upgrade-package-mailman-postfix-with-htdigfreebsd-upgrade-package-mailman-with-htdig
References
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.