~ / search / GHSA-xq58-69h2-765m

GHSA-xq58-69h2-765m

Cross Site Request Forgery in mailman

Source: GitHub Advisory Database (reviewed) High CVE-2021-44227

Packages

EcosystemPackageAffectedFixed in
PyPI mailman < 2.1.38 2.1.38

Details

As written in the advisory (Markdown source, shown as plain text).

In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.

References

External links from the advisory. They lead to third-party sites.