Published: 24/04/2020 Updated: 07/11/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 6.1 | Impact Score: 2.7 | Exploitability Score: 2.8

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

GNU Mailman 2.x prior to 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnu mailman
debian debian linux 9.0
debian debian linux 10.0
fedoraproject fedora 31
fedoraproject fedora 32
debian debian linux 8.0
canonical ubuntu linux 18.04
canonical ubuntu linux 16.04
opensuse leap 15.2
opensuse backports sle 15.0

Synopsis Moderate: mailman:21 security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for the mailman:21 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scori ...

Debian Bug report logs - #958930 mailman: CVE-2020-12137 Package: src:mailman; Maintainer for src:mailman is Mailman for Debian <pkg-mailman-hackers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 26 Apr 2020 19:33:01 UTC Severity: grave Tags: security, upstream Found in ve ...

Several security issues were fixed in Mailman ...

Hanno Boeck discovered that it was possible to create a cross site scripting attack on the webarchives of the Mailman mailing list manager, by sending a special type of attachement For the oldstable distribution (stretch), this problem has been fixed in version 1:2123-1+deb9u5 For the stable distribution (buster), this problem has been fixed in ...

oss-sec mailing list archives   By Date By Thread </form>    Re: mailman 2x: XSS via file attachments in list archives   From: Salvat ...

CWE-79 https://www.openwall.com/lists/oss-security/2020/02/24/3 https://www.openwall.com/lists/oss-security/2020/02/24/2 http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/head:/NEWS http://www.openwall.com/lists/oss-security/2020/04/24/3 https://www.debian.org/security/2020/dsa-4664 https://lists.debian.org/debian-lts-announce/2020/05/msg00002.html https://usn.ubuntu.com/4348-1/http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00047.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00063.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4COSBBEMJYLV7WSW5QTUJUOFJFK47KK/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6YCMGTTOXXCVM4O6CYZLTZDX6YLYORNF/https://access.redhat.com/errata/RHSA-2020:4667 https://usn.ubuntu.com/4348-1/https://nvd.nist.gov

CVE-2020-12137

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Mailing Lists

References

Vulmon Search

About

Products

Connect