PT-2016-2676 · Gnu+5 · Gnu Mailman+5

Nishant Agarwala · Published 2016-09-02 · Updated 2024-06-15 · CVE-2016-6893

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GNU Mailman versions 2.1.x through 2.1.22

Description A cross-site request forgery (CSRF) issue in the user options page allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, potentially gaining access to the credentials of a victim's account.

Recommendations For GNU Mailman versions 2.1.x through 2.1.22, update to version 2.1.23 or later to resolve the issue. As a temporary workaround, consider restricting access to the user options page until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

ALT-PU-2016-2014

ALT-PU-2018-1315

BDU:2016-02068

CESA-2021_4913

CVE-2016-6893

DLA-608-1

DSA-3668-1

MGASA-2016-0343

OPENSUSE-SU-2024:10215-1

RHSA-2021:4913

RHSA-2021_4913

SUSE-SU-2018:1638-1

SUSE-SU-2018:4296-1

SUSE-SU-2018_1638-1

SUSE-SU-2019:13924-1

SUSE-SU-2019:14068-1

SUSE-SU-2019_14068-1

USN-3118-1

Affected Products

Alt Linux

Centos

Gnu Mailman

Red Hat

Suse

Ubuntu

References · 41

• https://osv.dev/vulnerability/openSUSE-SU-2024:10215-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3118-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:4296-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:1638-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-6893 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0343.html · Security Note
• https://ubuntu.com/security/CVE-2016-7123 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-6893 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-6893 · Security Note
• https://osv.dev/vulnerability/USN-3118-1 · Vendor Advisory
• https://debian.org/security/2016/dsa-3668 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:13924-1 · Vendor Advisory
• http://debian.org/security/2016/dsa-3668 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:14068-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0343 · Vendor Advisory