CVE-2011-0707 Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) usern...
MediumCVSS 4.3
EPSS 4.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) username field in a confirmation message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU mailman | <= 2.1.14 | No fix listed |
| GNU mailman | = 1.0 | No fix listed |
| GNU mailman | = 1.1 | No fix listed |
| GNU mailman | = 2.0 | No fix listed |
| GNU mailman | = 2.0-beta3 | No fix listed |
| GNU mailman | = 2.0-beta4 | No fix listed |
| GNU mailman | = 2.0-beta5 | No fix listed |
| GNU mailman | = 2.0.1 | No fix listed |
| GNU mailman | = 2.0.2 | No fix listed |
| GNU mailman | = 2.0.3 | No fix listed |
| GNU mailman | = 2.0.4 | No fix listed |
| GNU mailman | = 2.0.5 | No fix listed |
| GNU mailman | = 2.0.6 | No fix listed |
| GNU mailman | = 2.0.7 | No fix listed |
| GNU mailman | = 2.0.8 | No fix listed |
| GNU mailman | = 2.0.9 | No fix listed |
| GNU mailman | = 2.0.10 | No fix listed |
| GNU mailman | = 2.0.11 | No fix listed |
| GNU mailman | = 2.0.12 | No fix listed |
| GNU mailman | = 2.0.13 | No fix listed |
| GNU mailman | = 2.0.14 | No fix listed |
| GNU mailman | = 2.1 | No fix listed |
| GNU mailman | = 2.1-alpha | No fix listed |
| GNU mailman | = 2.1-beta | No fix listed |
| GNU mailman | = 2.1-stable | No fix listed |
Show 20 more
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU mailman | = 2.1.1 | No fix listed |
| GNU mailman | = 2.1.1-beta1 | No fix listed |
| GNU mailman | = 2.1.2 | No fix listed |
| GNU mailman | = 2.1.3 | No fix listed |
| GNU mailman | = 2.1.4 | No fix listed |
| GNU mailman | = 2.1.5 | No fix listed |
| GNU mailman | = 2.1.5.8 | No fix listed |
| GNU mailman | = 2.1.6 | No fix listed |
| GNU mailman | = 2.1.7 | No fix listed |
| GNU mailman | = 2.1.8 | No fix listed |
| GNU mailman | = 2.1.9 | No fix listed |
| GNU mailman | = 2.1.10 | No fix listed |
| GNU mailman | = 2.1.11 | No fix listed |
| GNU mailman | = 2.1.11-rc1 | No fix listed |
| GNU mailman | = 2.1.11-rc2 | No fix listed |
| GNU mailman | = 2.1.12 | No fix listed |
| GNU mailman | = 2.1.13 | No fix listed |
| GNU mailman | = 2.1.13-rc1 | No fix listed |
| GNU mailman | = 2.1.14-rc1 | No fix listed |
| GNU mailman | = 2.1b1 | No fix listed |
References
- APPLE-SA-2011-10-12-3 vendor-advisory
- FEDORA-2011-2125 vendor-advisory
- FEDORA-2011-2102 vendor-advisory
- FEDORA-2011-2030 vendor-advisory
- SUSE-SR:2011:009 vendor-advisory
- openSUSE-SU-2011:0424 vendor-advisory
- [mailman-announce] 20110213 Mailman Security Patch Announcement mailing-list
- [mailman-announce] 20110218 Mailman Security Patch Announcement mailing-list patch
- 70936 vdb-entry
- 43294 third-party-advisory vendor-advisory
- 43389 third-party-advisory vendor-advisory
- 43425 third-party-advisory vendor-advisory
- 43549 third-party-advisory
- 43580 third-party-advisory
- 43829 third-party-advisory
- support.apple.com
- DSA-2170 vendor-advisory
- MDVSA-2011:036 vendor-advisory
- RHSA-2011:0307 vendor-advisory
- RHSA-2011:0308 vendor-advisory
- 46464 vdb-entry
- 1025106 vdb-entry
- USN-1069-1 vendor-advisory
- ADV-2011-0435 vdb-entry vendor-advisory
- ADV-2011-0436 vdb-entry vendor-advisory
- ADV-2011-0460 vdb-entry vendor-advisory
- ADV-2011-0487 vdb-entry
- ADV-2011-0542 vdb-entry
- ADV-2011-0720 vdb-entry
- mailman-fullname-xss(65538) vdb-entry