PT-2018-17241 · Gnu+5 · Mailman+5

Calum Hutton · Published 2018-01-23 · Updated 2020-11-10 · CVE-2018-5950

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Mailman versions prior to 2.1.26

Description: The issue is related to a cross-site scripting (XSS) vulnerability in the web UI. This allows remote attackers to inject arbitrary web script or HTML via a user-options URL. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations: For Mailman versions prior to 2.1.26, update to version 2.1.26 or later to resolve the issue. As a temporary workaround, consider restricting access to the web UI to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2018-1315

CESA-2018_0504

CESA-2018_0505

CVE-2018-5950

DLA-1272-1

DSA-4108-1

MGASA-2018-0184

RHSA-2018:0504

RHSA-2018:0505

RHSA-2018_0504

RHSA-2018_0505

SUSE-SU-2018:4296-1

SUSE-SU-2019:13924-1

USN-3563-1

Affected Products

Alt Linux

Centos

Mailman

Red Hat

Suse

Ubuntu

References · 35

• 🔥 http://packetstormsecurity.com/files/159761/Mailman-2.1.23-Cross-Site-Scripting.html · Exploit
• https://usn.ubuntu.com/3563-1 · Vendor Advisory
• https://bugs.launchpad.net/mailman/+bug/1747209 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2018:4296-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-5950 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4108-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-5950 · Security Note
• https://advisories.mageia.org/MGASA-2018-0184.html · Security Note
• https://access.redhat.com/errata/RHSA-2018:0505 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3563-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-5950 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5950 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:13924-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5950 · Security Note
• https://osv.dev/vulnerability/MGASA-2018-0184 · Vendor Advisory