Veracode Vulnerability DatabaseVERACODE:24421Cross-site Scripting (XSS)
3.5 Low
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
mailman is vulnerable to cross-site scripting (XSS). The vulnerability exists through multiple input sanitization flaws were found in the way Mailman displayed mailing list information. A mailing list administrator could use this flaw to conduct a cross-site scripting (XSS) attack against victims viewing a list’s “listinfo” page.
References
lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
lists.fedoraproject.org/pipermail/package-announce/2010-December/052297.html
lists.fedoraproject.org/pipermail/package-announce/2010-December/052312.html
lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
lists.opensuse.org/opensuse-updates/2011-05/msg00000.html
mail.python.org/pipermail/mailman-announce/2010-September/000150.html
mail.python.org/pipermail/mailman-announce/2010-September/000151.html
marc.info/?l=oss-security&m=128438736513097&w=2
marc.info/?l=oss-security&m=128440851513718&w=2
marc.info/?l=oss-security&m=128441135117819&w=2
marc.info/?l=oss-security&m=128441237618793&w=2
marc.info/?l=oss-security&m=128441369020123&w=2
secunia.com/advisories/41265
secunia.com/advisories/42502
secunia.com/advisories/43294
secunia.com/advisories/43425
secunia.com/advisories/43549
secunia.com/advisories/43580
support.apple.com/kb/HT4581
www.debian.org/security/2011/dsa-2170
www.redhat.com/support/errata/RHSA-2011-0307.html
www.redhat.com/support/errata/RHSA-2011-0308.html
www.ubuntu.com/usn/USN-1069-1
www.vupen.com/english/advisories/2010/3271
www.vupen.com/english/advisories/2011/0436
www.vupen.com/english/advisories/2011/0460
www.vupen.com/english/advisories/2011/0542
access.redhat.com/errata/RHSA-2011:0307
access.redhat.com/errata/RHSA-2011:0308
access.redhat.com/security/cve/CVE-2010-3089
access.redhat.com/security/updates/classification/#moderate
bugzilla.redhat.com/show_bug.cgi?id=631859
bugzilla.redhat.com/show_bug.cgi?id=631881
launchpad.net/mailman/+milestone/2.1.14rc1
Related
3.5 Low
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N