Mailman before 2.1.5 allows remote attackers to obtain user passwords via a crafted email request to the Mailman server.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Mailman before 2.1.5 allows remote attackers to obtain user passwords via a crafted email request to the
    Mailman server. (CVE-2004-0412)

Barry Warsaw reports :

Today I am releasing Mailman 2.1.5, a bug fix release [...] This version also contains a fix for an exploit that could allow 3rd parties to retrieve member passwords. It is thus highly recommended that all existing sites upgrade to the latest version.

The remote host is affected by the vulnerability described in GLSA-200406-04 (Mailman: Member password disclosure vulnerability)

    Mailman contains an unspecified vulnerability in the handling of request     emails.
  Impact :

    By sending a carefully crafted email request to the mailman server an     attacker could obtain member passwords.
  Workaround :

    There is no known workaround at this time.

Mailman versions >= 2.1 have an issue where 3rd parties can retrieve member passwords from the server. The updated packages have a patch backported from 2.1.5 to correct the issue.

The target is running a version of the Mailman mailing list software that allows a list subscriber to retrieve the mailman password of any other subscriber by means of a specially crafted mail message to the server.  That is, a message sent to $listname-request@$target containing the lines :

    password address=$victim     password address=$subscriber

will return the password of both $victim and $subscriber for the list $listname@$target. 

***** Nessus has determined the vulnerability exists on the target
***** simply by looking at the version number of Mailman installed
***** there.

ID	Name	Product	Family	Severity
434223	SCA: security update for mailman (GHSA-hj4h-vqpq-95wg)	Tenable Cloud Security	SCA Checks	high
434223	SCA: security update for mailman (GHSA-hj4h-vqpq-95wg)	Tenable Self-Hosted Container Security	SCA Checks	high
19079	FreeBSD : mailman -- password disclosure (ad9d2518-3471-4737-b60b-9a1f51023b28)	Nessus	FreeBSD Local Security Checks	medium
14515	GLSA-200406-04 : Mailman: Member password disclosure vulnerability	Nessus	Gentoo Local Security Checks	medium
14150	Mandrake Linux Security Advisory : mailman (MDKSA-2004:051)	Nessus	Mandriva Local Security Checks	medium
12253	Mailman Crated Email Remote User Password Disclosure	Nessus	Misc.	medium

Detections

Analytics

CVE-2004-0412

high

Tenable Plugins

high

high

medium

medium

medium

medium