PT-2016-2674 · Gnu+2 · Gnu Mailman+2

Published 2016-02-21 · Updated 2017-07-29 · CVE-2016-7123

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GNU Mailman versions prior to 2.1.15

Description The issue is related to a cross-site request forgery (CSRF) vulnerability in the admin web interface. This vulnerability allows remote attackers to hijack the authentication of administrators.

Recommendations For GNU Mailman versions prior to 2.1.15, update to version 2.1.15 or later to resolve the issue. As a temporary workaround, consider implementing additional authentication measures or restricting access to the admin web interface to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

ALT-PU-2016-1141

BDU:2016-02066

CVE-2016-7123

USN-3118-1

Affected Products

Alt Linux

Gnu Mailman

Ubuntu

References · 13

• https://cve.org/CVERecord?id=CVE-2016-7123 · Security Note
• https://osv.dev/vulnerability/CVE-2016-7123 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3118-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7123 · Security Note
• https://ubuntu.com/security/CVE-2016-6893 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-02066 · Security Note
• https://ubuntu.com/security/CVE-2016-7123 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-7123 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3118-1 · Vendor Advisory
• http://securitytracker.com/id/1037160 · Note
• http://securityfocus.com/bid/92732 · Note
• https://bugs.launchpad.net/bugs/1614841 · Note
• https://bugs.launchpad.net/mailman/+bug/1614841/comments/8 · Note