Home

CVE-2021-44227

Description

In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.

Risk Information

Base Score
8.8
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
0.344

Associated Vulnerability

VulnerabilityOS Platform
(RHSA-2021:4913) mailman security update mailman-2.1.15-30.el7_9.2.x86_64.rpmLinux
(RHSA-2021:4916) mailman:2.1 security update mailman-2.1.29-12.module+el8.5.0+13466+327eb9f3.2.x86_64.rpmLinux
(RHSA-2021:4916) mailman:2.1 security update mailman-debugsource-2.1.29-12.module+el8.5.0+13466+327eb9f3.2.x86_64.rpmLinux
Mailman update (ELSA-2021-4913) mailman-2.1.15-30.el7_9.2.x86_64.rpmLinux
Mailman update (ELSA-2021-4916) mailman-2.1.29-12.module+el8.5.0+20436+78a1860c.2.x86_64.rpmLinux
Web-based mailing list manager (USN-5180-1) mailman_2.1.26-1ubuntu0.6_i386.debLinux
Web-based mailing list manager (USN-5180-1) mailman_2.1.26-1ubuntu0.6_amd64.debLinux
SUSE-SU-2022:1886-1(SUSE Linux Enterprise Server 12-SP5 ) mailman-2.1.17-3.26.1.x86_64.rpmLinux
SUSE-SU-2022:1886-1(SUSE Linux Enterprise Server 12-SP5 ) mailman-debuginfo-2.1.17-3.26.1.x86_64.rpmLinux
SUSE-SU-2022:1886-1(SUSE Linux Enterprise Server 12-SP5 ) mailman-debugsource-2.1.17-3.26.1.x86_64.rpmLinux
(RHSA-2021:4916)Important: security update mailman-debuginfo-2.1.29-12.module+el8.5.0+13466+327eb9f3.2.x86_64.rpmLinux
(RHSA-2021:4913)Important: security update mailman-debuginfo-2.1.15-30.el7_9.2.x86_64.rpmLinux
mailman:2.1 security update (RLSA-2021:4916) mailman-2.1.29-12.module+el8.5.0+717+27fd1ba7.2.x86_64.rpmLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234