GNU Mailman
By the Year
In 2023 there have been 1 vulnerability in GNU Mailman with an average score of 6.3 out of ten. Mailman did not have any published security vulnerabilities last year. That is, 1 more vulnerability have already been reported in 2023 as compared to last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2023 | 1 | 6.30 |
| 2022 | 0 | 0.00 |
| 2021 | 5 | 6.74 |
| 2020 | 3 | 5.63 |
| 2019 | 0 | 0.00 |
| 2018 | 3 | 6.00 |
It may take a day or so for new Mailman vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent GNU Mailman Security Vulnerabilities
An issue was discovered in Mailman Core before 3.3.5
CVE-2021-34337
6.3 - Medium
- April 15, 2023
An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.
In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using
CVE-2021-44227
8.8 - High
- December 02, 2021
In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.
Session Riding
In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password
CVE-2021-43332
6.5 - Medium
- November 12, 2021
In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack.
Insufficiently Protected Credentials
In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page
CVE-2021-43331
6.1 - Medium
- November 12, 2021
In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.
XSS
GNU Mailman before 2.1.35 may allow remote Privilege Escalation
CVE-2021-42097
8 - High
- October 21, 2021
GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).
Session Riding
GNU Mailman before 2.1.35 may allow remote Privilege Escalation
CVE-2021-42096
4.3 - Medium
- October 21, 2021
GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin password, and may be useful in conducting a brute-force attack against that password.
Improper Restriction of Excessive Authentication Attempts
GNU Mailman before 2.1.33
CVE-2020-15011
4.3 - Medium
- June 24, 2020
GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page.
Injection
/options/mailman in GNU Mailman before 2.1.31
CVE-2020-12108
6.5 - Medium
- May 06, 2020
/options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection.
Injection
GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts
CVE-2020-12137
6.1 - Medium
- April 24, 2020
GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code.
XSS
Cross-site scripting vulnerability in Mailman 2.1.26 and earlier
CVE-2018-0618
5.4 - Medium
- July 26, 2018
Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
XSS
An issue was discovered in GNU Mailman before 2.1.28
CVE-2018-13796
6.5 - Medium
- July 12, 2018
An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site.
Improper Input Validation
Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26
CVE-2018-5950
6.1 - Medium
- January 23, 2018
Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL.
XSS
Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier
CVE-2011-0707
- February 22, 2011
Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) username field in a confirmation message.
XSS
Multiple cross-site scripting (XSS) vulnerabilities in GNU Mailman before 2.1.14rc1
CVE-2010-3089
- September 15, 2010
Multiple cross-site scripting (XSS) vulnerabilities in GNU Mailman before 2.1.14rc1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving (1) the list information field or (2) the list description field.
XSS
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for GNU Mailman or by GNU? Click the Watch button to subscribe.
