PT-2021-22867 · Gnu+2 · Gnu Mailman Postorius+2

Kevin Israel · Published 2021-09-09 · Updated 2024-03-14 · CVE-2021-40347

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions GNU Mailman Postorius versions prior to 1.3.5

Description An issue was discovered in views/list.py in GNU Mailman Postorius. An attacker, logged into any account, can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.

Recommendations For versions prior to 1.3.5, update to version 1.3.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the views/list.py module to minimize the risk of exploitation. Avoid using the vulnerable functionality in views/list.py until the issue is resolved.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2021-40347

DSA-4970-1

GHSA-V83X-78Q3-GR2J

OPENSUSE-SU-2024:12306-1

PYSEC-2021-319

USN-5157-1

Affected Products

Gnu Mailman Postorius

Linuxmint

Ubuntu

References · 24

• 🔥 https://gitlab.com/mailman/postorius/-/issues/531 · Exploit
• 🔥 https://phabricator.wikimedia.org/T289798 · Exploit
• https://osv.dev/vulnerability/USN-5157-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v83x-78q3-gr2j · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5157-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-40347 · Vendor Advisory
• https://gitlab.com/mailman/postorius/-/commit/3d880c56b58bc26b32eac0799407d74b64b7474b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-40347 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-319 · Vendor Advisory
• https://debian.org/security/2021/dsa-4970 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-40347 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-40347 · Security Note
• https://ubuntu.com/security/CVE-2021-40347 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-40347 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4970-1 · Vendor Advisory