Red Hat Security AdvisoryRHSA-2021:4913
mailman security update
Released 2021-12-02 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Server (v. 7) mailman-3:2.1.15-30.el7_9.2
- Red Hat Enterprise Linux Workstation (v. 7) mailman-3:2.1.15-30.el7_9.2
Fixes 3 records
Priority MEDIUM 41
Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as d…
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.01613 · Published 2016-09-02 · Partial fix CWE-352
Priority LOW 39
In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00757 · Published 2021-12-02 · Partial fix · 2.1.38 CWE-352
Priority LOW 38
GNU Mailman before 2.1.35 may allow remote Privilege Escalation.
CVSS 3.1HIGH 8.0· Network · Low privileges · User interaction · EPSS 0.01332 · Published 2021-10-21 · Partial fix CWE-352
