An issue exists in Mailman Core prior to 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for malicious users to exploit this, but can optionally be made to listen on other interfaces.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
gnu mailman |
Vulmon