Published: 22/02/2011 Updated: 13/02/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and previous versions allow remote malicious users to inject arbitrary web script or HTML via the (1) full name or (2) username field in a confirmation message.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnu mailman 2.1.13
gnu mailman 2.1.5
gnu mailman 2.1.11
gnu mailman 2.0.5
gnu mailman 2.0.1
gnu mailman 2.1.5.8
gnu mailman 2.1.3
gnu mailman 2.0.11
gnu mailman 2.0.6
gnu mailman 2.0
gnu mailman 2.1.8
gnu mailman 1.1
gnu mailman 2.0.14
gnu mailman 2.0.12
gnu mailman 2.1.2
gnu mailman 2.0.9
gnu mailman 2.1.9
gnu mailman 2.0.3
gnu mailman 2.1
gnu mailman 2.1.14
gnu mailman 2.0.13
gnu mailman 2.1.6
gnu mailman 2.0.4
gnu mailman 2.1b1
gnu mailman
gnu mailman 2.1.10
gnu mailman 2.1.1
gnu mailman 2.1.12
gnu mailman 1.0
gnu mailman 2.0.8
gnu mailman 2.1.7
gnu mailman 2.1.4
gnu mailman 2.0.10
gnu mailman 2.0.2
gnu mailman 2.0.7

It was discovered that Mailman did not properly sanitize certain fields, resulting in cross-site scripting (XSS) vulnerabilities With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, withi ...

Two cross site scripting vulnerabilities were been discovered in Mailman, a web-based mailing list manager These allowed an attacker to retrieve session cookies via inserting crafted JavaScript into confirmation messages (CVE-2011-0707) and in the list admin interface (CVE-2010-3089; oldstable only) For the oldstable distribution (lenny), these p ...

CWE-79 http://www.debian.org/security/2011/dsa-2170 http://mail.python.org/pipermail/mailman-announce/2011-February/000158.html http://secunia.com/advisories/43294 http://www.securityfocus.com/bid/46464 http://secunia.com/advisories/43389 http://www.vupen.com/english/advisories/2011/0435 http://www.vupen.com/english/advisories/2011/0436 http://mail.python.org/pipermail/mailman-announce/2011-February/000157.html http://secunia.com/advisories/43425 http://www.mandriva.com/security/advisories?name=MDVSA-2011:036 http://www.vupen.com/english/advisories/2011/0460 http://www.securitytracker.com/id?1025106 http://www.ubuntu.com/usn/USN-1069-1 http://www.vupen.com/english/advisories/2011/0487 http://osvdb.org/70936 http://secunia.com/advisories/43580 http://secunia.com/advisories/43549 http://www.redhat.com/support/errata/RHSA-2011-0308.html http://www.vupen.com/english/advisories/2011/0542 http://www.redhat.com/support/errata/RHSA-2011-0307.html http://secunia.com/advisories/43829 http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056363.html http://www.vupen.com/english/advisories/2011/0720 http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056387.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056399.html http://support.apple.com/kb/HT5002 http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html http://lists.opensuse.org/opensuse-updates/2011-05/msg00000.html https://exchange.xforce.ibmcloud.com/vulnerabilities/65538 https://usn.ubuntu.com/1069-1/https://nvd.nist.gov

CVE-2011-0707

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect