GitHub Advisoryadvisory · PyPI

GHSA-xq58-69h2-765m Cross Site Request Forgery in mailman

HIGH Published 2021-12-16 Modified 2021-12-06 Official page ↗
Aliases
CVE-2021-44227
Ecosystem
PyPI
Packages
mailman
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2021-12-06

Affected packages

• PyPI mailman: < 2.1.38 → fixed in 2.1.38

Description

In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.

Related

Alias · CVE (1)

  • CVE-2021-44227 In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References