CVE-2016-6893

Published: 2 September 2016

Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account.

Priority

CVSS 3 base score: 8.8

Status

Package	Release	Status
mailman Launchpad, Ubuntu, Debian	precise	Released (1:2.1.14-3ubuntu0.4)
	trusty	Does not exist (trusty was released [1:2.1.16-2ubuntu0.2])
	upstream	Needs triage
	xenial	Released (1:2.1.20-1ubuntu0.1)
	yakkety	Released (1:2.1.22-1ubuntu0.1)

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6893
https://mail.python.org/pipermail/mailman-announce/2016-August/000225.html
https://ubuntu.com/security/notices/USN-3118-1
NVD
Launchpad
Debian

Bugs

https://bugs.launchpad.net/mailman/+bug/1614841 (mailman)
https://bugs.launchpad.net/ubuntu/+source/mailman/+bug/1632244 (mailman in ubuntu)
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=835970

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›