The version of mailman installed on the remote host is prior to 2.1.15-30. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2370 advisory.

  - In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary     JavaScript for XSS. (CVE-2021-43331)

  - In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted     version of the list admin password. This could potentially be cracked by a moderator via an offline brute-     force attack. (CVE-2021-43332)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5151-2 advisory.

  - In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary     JavaScript for XSS. (CVE-2021-43331)

  - In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted     version of the list admin password. This could potentially be cracked by a moderator via an offline brute-     force attack. (CVE-2021-43332)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5151-1 advisory.

  - In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary     JavaScript for XSS. (CVE-2021-43331)

  - In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted     version of the list admin password. This could potentially be cracked by a moderator via an offline brute-     force attack. (CVE-2021-43332)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - mailman: XSS in Cgi/options.py via crafted URL (CVE-2021-43331)

  - mailman: a list moderator can crack the list admin password encrypted in a CSRF token (CVE-2021-43332)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3049 advisory.

  - In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary     JavaScript for XSS. (CVE-2021-43331)

  - In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted     version of the list admin password. This could potentially be cracked by a moderator via an offline brute-     force attack. (CVE-2021-43332)

  - In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request     (using that token) to set a new admin password or make other changes. (CVE-2021-44227)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1886-1 advisory.

  - GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived     from the admin password, and may be useful in conducting a brute-force attack against that password.
    (CVE-2021-42096)

  - In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary     JavaScript for XSS. (CVE-2021-43331)

  - In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted     version of the list admin password. This could potentially be cracked by a moderator via an offline brute-     force attack. (CVE-2021-43332)

  - In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request     (using that token) to set a new admin password or make other changes. (CVE-2021-44227)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the mailman package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary     JavaScript for XSS. (CVE-2021-43331)

  - In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted     version of the list admin password. This could potentially be cracked by a moderator via an offline brute-     force attack. (CVE-2021-43332)

  - In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request     (using that token) to set a new admin password or make other changes. (CVE-2021-44227)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - mailman: CSRF token bypass allows to perform CSRF attacks and account takeover (CVE-2021-42097)

  - mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover (CVE-2021-44227)

  - Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before     2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an     option, as demonstrated by gaining access to the credentials of a victim's account. (CVE-2016-6893)

  - Cross-site request forgery (CSRF) vulnerability in the admin web interface in GNU Mailman before 2.1.15     allows remote attackers to hijack the authentication of administrators. (CVE-2016-7123)

  - Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to     inject arbitrary web script or HTML via unspecified vectors. (CVE-2018-0618)

  - An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be     displayed on a web page from a trusted site. (CVE-2018-13796)

  - /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection. (CVE-2020-12108)

  - GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts.
    This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an     archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the     MIME type should have been text/html, and execute JavaScript code. (CVE-2020-12137)

  - GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login     page. (CVE-2020-15011)

  - In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary     JavaScript for XSS. (CVE-2021-43331)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
186562	Amazon Linux 2 : mailman (ALAS-2023-2370)	Nessus	Amazon Linux Local Security Checks	12/4/2023	12/4/2023	medium
183591	Ubuntu 20.04 ESM : Mailman vulnerabilities (USN-5151-2)	Nessus	Ubuntu Local Security Checks	10/20/2023	10/20/2023	medium
155602	Ubuntu 16.04 ESM / 18.04 LTS : Mailman vulnerabilities (USN-5151-1)	Nessus	Ubuntu Local Security Checks	11/18/2021	10/16/2023	medium
195544	RHEL 7 : mailman (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	medium
161990	Debian DLA-3049-1 : mailman - LTS security update	Nessus	Debian Local Security Checks	6/9/2022	6/9/2022	high
161744	SUSE SLES12 Security Update : mailman (SUSE-SU-2022:1886-1)	Nessus	SuSE Local Security Checks	6/1/2022	7/14/2023	high
161572	EulerOS 2.0 SP3 : mailman (EulerOS-SA-2022-1745)	Nessus	Huawei Local Security Checks	5/26/2022	5/26/2022	high
195510	RHEL 6 : mailman (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

high

high

high

high