CVE-2021-44227: Cross Site Request Forgery in mailman
Summary
CVE-2021-44227: Cross Site Request Forgery in mailman. Affects mailman versions < 2.1.38. Fixed in 2.1.38. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mailman is an open-source software package that manages electronic mailing lists. It provides a web interface for list administration, allowing list members and moderators to perform various actions. This vulnerability affects versions of Mailman prior to 2.1.38.
Vulnerability Detail
The vulnerability identified as CVE-2021-44227 in Mailman allows a list member or moderator to obtain a Cross-Site Request Forgery (CSRF) token. With this token, an attacker can craft an admin request and execute actions on behalf of an administrator. This includes setting a new admin password or making other unauthorized changes. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
2.1.38
This is the first release that contains the fix.
pip install --upgrade "mailman==2.1.38"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the CVE-2021-44227 vulnerability in Mailman allows a list member or moderator to perform unauthorized administrative actions. To mitigate this vulnerability, it is crucial to upgrade to Mailman version 2.1.38 or later. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mailman →
FAQ
Mailman is an open-source software package used for managing electronic mailing lists.
A CSRF token is a unique identifier generated by a web application to protect against Cross-Site Request Forgery attacks. It is used to validate the authenticity of requests made by users.
An attacker who is a list member or moderator can obtain a CSRF token and use it to craft an admin request. This allows them to perform unauthorized actions on the Mailman system, such as changing the admin password.
The vulnerability allows an attacker to gain unauthorized access to the Mailman system and perform administrative actions. This can lead to a compromise of the mailing list and potentially sensitive information.
Yes, upgrading to Mailman version 2.1.38 or later fixes the CSRF vulnerability and prevents unauthorized admin actions.
Related vulnerabilities
Recent vulnerabilities recorded for mailman.
