Mark Sapiro

**Name of the Vulnerable Software and Affected Versions** GNU Mailman versions prior to 2.1.38 **Description** The issue is related to insufficient validation of the source of HTTP requests in GNU Mailman, allowing a remote attacker to force a victim to visit a special web page and perform arbitrary actions on behalf of the victim on the vulnerable website. Specifically, a list member or moderator can obtain a CSRF token and craft an admin request to set a new admin password or make other changes. **Recommendations** For GNU Mailman versions prior to 2.1.38, update to version 2.1.38 or later to resolve the issue. As a temporary workaround, consider restricting access to admin requests to minimize the risk of exploitation. Additionally, restrict the ability of list members or moderators to obtain CSRF tokens until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** GNU Mailman versions prior to 2.1.36 **Description** The issue is related to a crafted URL to the "Cgi/options.py" user options page, which can execute arbitrary JavaScript for XSS. This is due to inadequate protection of the web page structure. A remote attacker can exploit this to execute arbitrary JavaScript code. **Recommendations** For GNU Mailman versions prior to 2.1.36, update to version 2.1.36 or later to resolve the issue. As a temporary workaround, consider restricting access to the Cgi/options.py page until a patch is available. Avoid using the page for sensitive operations until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** GNU Mailman versions prior to 2.1.36 **Description** The issue is related to insufficient restriction of authentication attempts in GNU Mailman, allowing a remote attacker to bypass authentication by guessing the administrator's password using a brute-force method. Specifically, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password, which could potentially be cracked by a moderator via an offline brute-force attack. **Recommendations** For GNU Mailman versions prior to 2.1.36, update to version 2.1.36 or later to resolve the issue. As a temporary workaround, consider restricting access to the Cgi/admindb.py admindb page to minimize the risk of exploitation. Additionally, restrict the use of the encrypted admin password in the CSRF token until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** GNU Mailman versions prior to 2.1.33 **Description** The issue exists due to insufficient input validation in the Cgi/private.py private archive login page of the GNU Mailman mailing list management system. This allows a remote attacker to inject arbitrary content using a specially crafted request. **Recommendations** For GNU Mailman versions prior to 2.1.33, update to version 2.1.33 or later to resolve the issue. As a temporary workaround, consider restricting access to the Cgi/private.py private archive login page to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GNU Mailman versions prior to 2.1.31 **Description** The issue allows for Arbitrary Content Injection through the `/options/mailman` endpoint. **Recommendations** For GNU Mailman versions prior to 2.1.31, update to version 2.1.31 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** GNU Mailman versions prior to 2.1.20 **Description** The issue allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name, when not using a static alias. **Recommendations** For GNU Mailman versions prior to 2.1.20, update to version 2.1.20 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** GNU Mailman versions prior to 2.1.14rc1 **Description** The issue involves multiple cross-site scripting (XSS) vulnerabilities that allow remote authenticated users to inject arbitrary web script or HTML. This can be achieved through vectors involving the list information field or the list description field. **Recommendations** For GNU Mailman versions prior to 2.1.14rc1, update to version 2.1.14rc1 or later to resolve the issue. As a temporary workaround, consider restricting access to the list information and description fields to minimize the risk of exploitation.