~ / search / GHSA-v83x-78q3-gr2j

GHSA-v83x-78q3-gr2j

GNU Mailman Postorius Access Control Issues

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-40347

Packages

EcosystemPackageAffectedFixed in
PyPI postorius < 1.3.5 1.3.5

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in `views/list.py` in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.

References

External links from the advisory. They lead to third-party sites.