Stored cross-site scripting in Mailman - CVE-2020-12137

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU27366

Stored cross-site scripting in Mailman - CVE-2020-12137

Published: April 27, 2020


Vulnerability identifier: #VU27366
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2020-12137
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to mailman uses the .obj extension for scrubbed application/octet-stream MIME parts. A remote attacker can send a specially crafted attachment to the list, trick the victim to open the email in the list archive and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


Affected software

Mailman
mailman (Ubuntu package)
mailman (Debian package)
mailman
mailman-debugsource
mailman-debuginfo
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Oracle Solaris
openEuler
Ubuntu
Fedora

How to mitigate CVE-2020-12137

Install updates from vendor's website.

Mailman - update to 2.1.30
mailman (Ubuntu package) - addressed in versions 1:2.1.20-1ubuntu0.4, 1:2.1.26-1ubuntu0.1, 1:2.1.29-1ubuntu3.1
mailman (Debian package) - addressed in versions 2.1.23-1+deb9u5, 2.1.29-1+deb10u1
mailman - update to 2.1.29-8
mailman-debugsource - update to 2.1.29-8
mailman-debuginfo - update to 2.1.29-8
mailman - addressed in versions 2.1.30-1.fc31, 2.1.32-2.fc32

External References

Related Security Bulletins