Description

GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin password, and may be useful in conducting a brute-force attack against that password.

Remediation

References

CVE-2021-42096

Related Vulnerabilities

Jenkins Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2023-43497)

Serendipity Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2006-6242)

WebLogic CVE-2023-22031 Vulnerability (CVE-2023-22031)

Jboss EAP Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-3369)

WordPress Plugin Contact Form 7-Clockwork SMS Cross-Site Scripting (2.3.0)

Severity

Medium

Classification

CVE-2021-42096 CWE-307 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities