Exposure of sensitive information to an unauthorized actor in HyperKitty

2021-06-0121:56:23

Google

osv.dev

0.007 Low

EPSS

Percentile

80.6%

JSON

An issue was discovered in management/commands/hyperkitty_import.py in HyperKitty prior to 1.3.5. When importing a private mailing list’s archives, these archives are publicly visible for the duration of the import. For example, sensitive information might be available on the web for an hour during a large migration from Mailman 2 to Mailman 3.

CPENameOperatorVersion
hyperkittyeq1.3.4
hyperkittyeq0.1.7
hyperkittyeq1.3.4rc2
hyperkittyeq0.1
hyperkittyeq1.3.4rc1
hyperkittyeq1.3.3
hyperkittyeq1.3.3rc2
hyperkittyeq0.1.4
hyperkittyeq1.2.0a1
hyperkittyeq1.1.4

Name	Operator	Version
hyperkitty	eq	1.3.4
hyperkitty	eq	0.1.7
hyperkitty	eq	1.3.4rc2
hyperkitty	eq	0.1
hyperkitty	eq	1.3.4rc1
hyperkitty	eq	1.3.3
hyperkitty	eq	1.3.3rc2
hyperkitty	eq	0.1.4
hyperkitty	eq	1.2.0a1
hyperkitty	eq	1.1.4