CVE-2021-43332
published 2021-11-12CVE-2021-43332: In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could…
medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| gnu | mailman | < 2.1.36 | 2.1.36 |
| gnu | mailman | >= 0 < 1:2.1.26-1ubuntu0.5 | 1:2.1.26-1ubuntu0.5 |
| gnu | mailman | >= 0 < 1:2.1.20-1ubuntu0.6+esm2 | 1:2.1.20-1ubuntu0.6+esm2 |
| gnu | mailman | >= 0 < 1:2.1.29-1ubuntu3.1+esm1 | 1:2.1.29-1ubuntu3.1+esm1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
osv6.5MEDIUM