All errata/sisyphus/ALT-PU-2016-2014-1
ALT-PU-2016-2014-1

Package update mailman in branch sisyphus

Version2.1.23-alt0.1.20160915
Task#169886
Published2016-09-24
Max severityHIGH
Severity:

Closed issues (2)

BDU:2016-02068
MEDIUM6.8

Уязвимость системы управления почтовыми рассылками GNU Mailman, позволяющая нарушителю получить доступ к аутентификационным данным произвольных пользователей

Published: 2016-09-07Modified: 2021-03-23
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P
References
CVE-2016-6893
HIGH8.8

Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account.

Published: 2016-09-02Modified: 2025-04-12
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References