GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin password, and may be useful in conducting a brute-force attack against that password.
References
Link | Resource |
---|---|
http://www.openwall.com/lists/oss-security/2021/10/21/4 | Mailing List Patch Third Party Advisory |
https://bugs.launchpad.net/mailman/+bug/1947639 | Patch Third Party Advisory |
https://mail.python.org/archives/list/mailman-announce%40python.org/thread/IKCO6JU755AP5G5TKMBJL6IEZQTTNPDQ/ | |
https://www.debian.org/security/2021/dsa-4991 | Third Party Advisory |
Configurations
History
07 Nov 2023, 03:39
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
05 Nov 2021, 18:28
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : 4.0
v3 : 4.3 |
References | (MLIST) http://www.openwall.com/lists/oss-security/2021/10/21/4 - Mailing List, Patch, Third Party Advisory |
26 Oct 2021, 01:22
Type | Values Removed | Values Added |
---|---|---|
References | (CONFIRM) https://bugs.launchpad.net/mailman/+bug/1947639 - Patch, Third Party Advisory | |
References | (DEBIAN) https://www.debian.org/security/2021/dsa-4991 - Third Party Advisory | |
References | (MLIST) http://www.openwall.com/lists/oss-security/2021/10/21/4 - Patch, Third Party Advisory | |
References | (CONFIRM) https://mail.python.org/archives/list/mailman-announce@python.org/thread/IKCO6JU755AP5G5TKMBJL6IEZQTTNPDQ/ - Patch, Third Party Advisory | |
CVSS |
v2 : v3 : |
v2 : 6.8
v3 : 6.5 |
CPE | cpe:2.3:a:gnu:mailman:*:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
|
CWE | CWE-307 |
23 Oct 2021, 11:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
21 Oct 2021, 21:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
21 Oct 2021, 01:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-10-21 01:15
Updated : 2023-12-10 14:09
NVD link : CVE-2021-42096
Mitre link : CVE-2021-42096
CVE.ORG link : CVE-2021-42096
JSON object : View
Products Affected
gnu
- mailman
debian
- debian_linux
CWE
CWE-307
Improper Restriction of Excessive Authentication Attempts