PT-2020-5771 · Renaud Dubois Christophe Wolfhugel Olivier Salauen +2 · Sympa +2

🗓️ 24 Mar 2020 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 1 Views

Sympa versions before 6.2.56 lack privilege management, risking data confidentiality, integrity, and service.

Reporter	Title	Published	Views	Family All 167
FreeBSD	sympa -- Unauthorised full access via SOAP API due to illegal cookie	24 Nov 202000:00	–	freebsd
FreeBSD	sympa -- Denial of service caused by malformed CSRF token	24 Feb 202000:00	–	freebsd
BDU FSTEC	The vulnerability in the web interface (wwsympa.fcgi) of the Sympa mailing list manager allows a perpetrator to escalate their privileges.	12 Aug 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Sympa mailing list manager, related to a bug in the resource consumption monitoring mechanism, allows a violator to trigger a service failure.	30 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the authenticateAndRun function in the Sympa mailing list manager, related to the lack of authentication mechanisms, allows attackers to access confidential data.	30 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of Sympa mailing list managers, related to the lack of a mechanism for managing privileges, allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.	30 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the debian/sympa.postinst component of the Sympa mailing list manager allows a perpetrator to compromise the integrity of data by improperly assigning permissions for critical resources.	30 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of Sympa mailing list managers, related to the use of open redirection, allows attackers to compromise the confidentiality and integrity of the protected information.	27 Apr 202100:00	–	bdu_fstec
Huntr	Cross-site Scripting (XSS) - Reflected in keystonejs/keystone	30 Dec 202116:29	–	huntr
Circl	CVE-2020-10936	27 May 202022:55	–	circl

Source	Link
sysdream	www.sysdream.com/news/lab/2020-05-25-cve-2020-10936-sympa-privileges-escalation-to-root
ubuntu	www.ubuntu.com/security/notices/USN-4442-2
osv	www.osv.dev/vulnerability/DSA-4818-1
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3J4NZLGAF4ZYK52XEBQDTBNHLGBEPXXN
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
bdu	www.bdu.fstec.ru/vul/2021-01717
security-tracker	www.security-tracker.debian.org/tracker/CVE-2020-10936
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/P3TMQ3CORUOWARALACCBG2SBTIGZ5GY5
bdu	www.bdu.fstec.ru/vul/2021-01730

08 Nov 2022 00:00Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.17.8

CVSS 27.5

CVSS 39.8

EPSS0.03982