Unknown · Gnu Mailman · CVE-2021-43332
**Name of the Vulnerable Software and Affected Versions**
GNU Mailman versions prior to 2.1.36
**Description**
The issue is related to insufficient restriction of authentication attempts in GNU Mailman, allowing a remote attacker to bypass authentication by guessing the administrator's password using a brute-force method. Specifically, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password, which could potentially be cracked by a moderator via an offline brute-force attack.
**Recommendations**
For GNU Mailman versions prior to 2.1.36, update to version 2.1.36 or later to resolve the issue. As a temporary workaround, consider restricting access to the Cgi/admindb.py admindb page to minimize the risk of exploitation. Additionally, restrict the use of the encrypted admin password in the CSRF token until the issue is resolved.