Cross-site request forgery in Mailman - CVE-2016-6893

Vulnerability identifier: #VU365

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-6893

CWE-ID: CWE-352

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows attackers to perform cross-site request forgery attacks.

The vulnerability exists due to incorrect validation of HTTP request origin. A remote attacker can trick the victim to visit a malicious page with CSRF exploit and obtain victim's password.

Successful exploitation of this vulnerability will allow an attacker to compromise vulnerable application.

Mailman
Amazon Linux AMI
CentOS
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Power, little endian
Fedora
mailman (Red Hat package)
mailman

Update to version 2.1.23.

mailman (Red Hat package) - update to 2.1.15-30.el7_9.2
mailman - addressed in versions 2.1.21-8.fc27, 2.1.26-1.fc28

• CSRF attack in GNU Mailman
• Amazon Linux AMI update for mailman
• CentOS 7 update for mailman
• Red Hat Enterprise Linux 7 update for mailman
• Fedora 27 update for mailman
• Fedora 28 update for mailman