Published: 05/09/2002 Updated: 05/09/2008

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 760

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Cross-site scripting vulnerability in Mailman prior to 2.0.12 allows remote malicious users to execute script as other users via a subscriber's list subscription options in the (1) adminpw or (2) info parameters to the ml-name feature.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnu mailman 2.0.12

A cross-site scripting vulnerability was discovered in mailman, a software to manage electronic mailing lists When a properly crafted URL is accessed with Internet Explorer (other browsers don't seem to be affected), the resulting webpage is rendered similar to the real one, but the javascript component is executed as well, which could be used by ...

source: wwwsecurityfocuscom/bid/5298/info GNU Mailman is prone to a cross-site scripting vulnerability Arbitrary HTML and script code are not sanitized from the URI parameters of mailing list subscribe scripts An attacker may exploit this issue by creating a malicious link containing arbitrary script code and enticing a web user to vis ...

source: wwwsecurityfocuscom/bid/5299/info GNU Mailman is prone to a cross-site scripting vulnerability An attacker may construct a malicious link to the administrative login page, which contains arbitrary HTML and script code A user visiting the link will have the attacker's script code executed in their web browser in the context of ...

NVD-CWE-Other http://mail.python.org/pipermail/mailman-announce/2002-July/000043.html http://www.iss.net/security_center/static/9985.php http://www.securityfocus.com/bid/5298 http://archives.neohapsis.com/archives/bugtraq/2002-07/0268.html http://www.redhat.com/support/errata/RHSA-2002-176.html http://www.redhat.com/support/errata/RHSA-2002-177.html http://www.redhat.com/support/errata/RHSA-2002-178.html http://www.redhat.com/support/errata/RHSA-2002-181.html http://www.debian.org/security/2002/dsa-147 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000522 https://nvd.nist.gov https://www.debian.org/security/./dsa-147 https://www.exploit-db.com/exploits/21641/

CVE-2002-0855

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect