Cross-site request forgery in Mailman - CVE-2021-44227

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU58503

Cross-site request forgery in Mailman - CVE-2021-44227

Published: December 3, 2021 / Updated: December 6, 2021


Vulnerability identifier: #VU58503
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-44227
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website, such as get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.


Affected software

Mailman
CentOS
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
Anolis OS
HPE Helion Openstack
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Oracle Solaris
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
Ubuntu
openEuler
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
mailman (Red Hat package)
mailman
mailman-debuginfo
mailman-debugsource
mailman (Ubuntu package)

How to mitigate CVE-2021-44227

Install update from vendor's website.

Mailman - update to 2.1.38
mailman (Red Hat package) - update to 2.1.15-30.el7_9.2
mailman - update to 2.1.17-3.26.1
mailman-debuginfo - update to 2.1.17-3.26.1
mailman-debugsource - update to 2.1.17-3.26.1
mailman (Ubuntu package) - addressed in versions 1:2.1.20-1ubuntu0.6+esm3, 1:2.1.26-1ubuntu0.6, 1:2.1.29-1ubuntu3.1+esm2
mailman - addressed in versions 2.1.29-6, 2.1.29-12
mailman - update to 2.1.36-2
mailman-debugsource - update to 2.1.36-2
mailman-debuginfo - update to 2.1.36-2

External References

Related Security Bulletins