CVE-2018-5950 Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL.
MediumCVSS 6.1
EPSS 4.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU mailman | < 2.1.26 | 2.1.26 |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 17.10 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.4 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
References
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 104594 third-party-advisory vdb-entry
- RHSA-2018:0504 third-party-advisory vendor-advisory
- RHSA-2018:0505 third-party-advisory vendor-advisory
- bugs.launchpad.net issue-tracking patch third-party-advisory
- [debian-lts-announce] 20180209 [SECURITY] [DLA 1272-1] mailman security update mailing-list third-party-advisory
- USN-3563-1 third-party-advisory vendor-advisory
- DSA-4108 third-party-advisory vendor-advisory
- [mailman-users] 20180120 Mailman 2.1.26 Security release Feb 4, 2018 mailing-list