Cross-site scripting (XSS) vulnerability in options.py for Mailman 2.1 allows remote attackers to inject script or HTML into web pages via the (1) email or (2) language parameters.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cross-site scripting (XSS) vulnerability in options.py for Mailman 2.1 allows remote attackers to inject
    script or HTML into web pages via the (1) email or (2) language parameters. (CVE-2003-0038)

From the 2.1.1 release notes :

Closed a cross-site scripting vulnerability in the user options page.

Several vulnerabilities have been fixed in the mailman package :

  - CAN-2003-0038 - potential cross-site scripting via     certain CGI parameters (not known to be exploitable in     this version)
  - CAN-2003-0965 - cross-site scripting in the     administrative interface

  - CAN-2003-0991 - certain malformed email commands could     cause the mailman process to crash

The cross-site scripting vulnerabilities could allow an attacker to perform administrative operations without authorization, by stealing a session cookie.

ID	Name	Product	Family	Type	Severity
436988	SCA: security update for mailman (GHSA-82rm-28q9-435p)	Tenable Cloud Security	SCA Checks	Local	medium
436988	SCA: security update for mailman (GHSA-82rm-28q9-435p)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
37723	FreeBSD : mailman XSS in user options page (00263aa3-67a8-11d8-80e3-0020ed76ef5a)	Nessus	FreeBSD Local Security Checks	Local	medium
15273	Debian DSA-436-1 : mailman - several vulnerabilities	Nessus	Debian Local Security Checks	Local	medium

Detections

Analytics

CVE-2003-0038

medium

Tenable Plugins

medium

medium

medium

medium