PT-2016-2676 · Gnu+5 · Gnu Mailman+5
Nishant Agarwala
·
Publicado
2016-09-02
·
Atualizado
2024-06-15
·
CVE-2016-6893
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
GNU Mailman versions 2.1.x through 2.1.22
Description
A cross-site request forgery (CSRF) issue in the user options page allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, potentially gaining access to the credentials of a victim's account.
Recommendations
For GNU Mailman versions 2.1.x through 2.1.22, update to version 2.1.23 or later to resolve the issue.
As a temporary workaround, consider restricting access to the user options page until a patch is available.
Correção
CSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Gnu Mailman
Red Hat
Suse
Ubuntu