PT-2021-23076 · Dada Mail · Dada Mail

Justingit · Published 2021-09-20 · Updated 2021-10-01 · CVE-2021-41083

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dada Mail versions 11.15.1 and below

Description A CSRF vulnerability in Dada Mail allows a bad actor to control the list control panel as if they were logged in themselves. This can be achieved by giving the target a carefully crafted web page via email, SMS, etc. The vulnerability affects profile logins and allows the bad actor to change mailing list passwords and the Dada Mail Root Password, potentially shutting out actual list owners. For this vulnerability to work, the target must be logged into the list control panel. Although no known exploits have happened in the wild, the vulnerability has been confirmed by testing and a third party.

Recommendations Update to version 11.16.0 to resolve the issue. As a temporary workaround, consider restricting access to the list control panel to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-41083

GHSA-344M-P829-2R38

Affected Products

Dada Mail

References · 5

• https://github.com/justingit/dada-mail/commit/d4d3d86d08c816b4da75a5ef45abc12188772459 · Patch
• https://osv.dev/vulnerability/CVE-2021-41083 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41083 · Security Note
• https://github.com/justingit/dada-mail/security/advisories/GHSA-344m-p829-2r38 · Note
• https://t.me/cvenotify/21200 · Telegram Post