CVE-2010-3089

low
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Multiple cross-site scripting (XSS) vulnerabilities in GNU Mailman before 2.1.14rc1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving (1) the list information field or (2) the list description field.

References

http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052297.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052312.html

http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html

http://lists.opensuse.org/opensuse-updates/2011-05/msg00000.html

http://mail.python.org/pipermail/mailman-announce/2010-September/000150.html

http://mail.python.org/pipermail/mailman-announce/2010-September/000151.html

http://marc.info/?l=oss-security&m=128438736513097&w=2

http://marc.info/?l=oss-security&m=128440851513718&w=2

http://marc.info/?l=oss-security&m=128441135117819&w=2

http://marc.info/?l=oss-security&m=128441237618793&w=2

http://marc.info/?l=oss-security&m=128441369020123&w=2

http://secunia.com/advisories/41265

http://secunia.com/advisories/42502

http://secunia.com/advisories/43294

http://secunia.com/advisories/43425

http://secunia.com/advisories/43549

http://secunia.com/advisories/43580

http://support.apple.com/kb/HT4581

http://www.debian.org/security/2011/dsa-2170

http://www.redhat.com/support/errata/RHSA-2011-0307.html

http://www.redhat.com/support/errata/RHSA-2011-0308.html

http://www.ubuntu.com/usn/USN-1069-1

http://www.vupen.com/english/advisories/2010/3271

http://www.vupen.com/english/advisories/2011/0436

http://www.vupen.com/english/advisories/2011/0460

http://www.vupen.com/english/advisories/2011/0542

https://bugzilla.redhat.com/show_bug.cgi?id=631859

https://bugzilla.redhat.com/show_bug.cgi?id=631881

https://launchpad.net/mailman/+milestone/2.1.14rc1

Details

Source: MITRE

Published: 2010-09-15

Updated: 2014-02-21

Type: CWE-79

Risk Information

CVSS v2

Base Score: 3.5

Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 6.8

Severity: LOW

Tenable Plugins

View all (23 total)

IDNameProductFamilySeverity
75641openSUSE Security Update : mailman (openSUSE-SU-2011:0312-1)NessusSuSE Local Security Checks
medium
68211Oracle Linux 6 : mailman (ELSA-2011-0308)NessusOracle Linux Local Security Checks
medium
68210Oracle Linux 4 / 5 : mailman (ELSA-2011-0307)NessusOracle Linux Local Security Checks
medium
60969Scientific Linux Security Update : mailman on SL6.x i386/x86_64NessusScientific Linux Local Security Checks
medium
60968Scientific Linux Security Update : mailman on SL4.x, SL5.x i386/x86_64NessusScientific Linux Local Security Checks
medium
57225SuSE 10 Security Update : mailman (ZYPP Patch Number 7484)NessusSuSE Local Security Checks
medium
54579Mailman < 2.1.14 Multiple XSSNessusCGI abuses : XSS
low
53768openSUSE Security Update : mailman (openSUSE-SU-2011:0424-1)NessusSuSE Local Security Checks
medium
53639SuSE 10 Security Update : mailman (ZYPP Patch Number 7489)NessusSuSE Local Security Checks
medium
53619SuSE 11.1 Security Update : mailman (SAT Patch Number 4433)NessusSuSE Local Security Checks
medium
52754Mac OS X 10.6.x < 10.6.7 Multiple VulnerabilitiesNessusMacOS X Local Security Checks
high
52753Mac OS X Multiple Vulnerabilities (Security Update 2011-001)NessusMacOS X Local Security Checks
high
800796Mac OS X 10.6 < 10.6.7 Multiple VulnerabilitiesLog Correlation EngineOperating System Detection
high
5826Mac OS X 10.6 < 10.6.7 Multiple VulnerabilitiesNessus Network MonitorGeneric
critical
52506CentOS 4 / 5 : mailman (CESA-2011:0307)NessusCentOS Local Security Checks
medium
52492RHEL 6 : mailman (RHSA-2011:0308)NessusRed Hat Local Security Checks
medium
52491RHEL 4 / 5 : mailman (RHSA-2011:0307)NessusRed Hat Local Security Checks
medium
52070Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : mailman vulnerabilities (USN-1069-1)NessusUbuntu Local Security Checks
medium
52037Debian DSA-2170-1 : mailman - several vulnerabilitiesNessusDebian Local Security Checks
medium
51345Fedora 13 : mailman-2.1.12-16.fc13 (2010-14877)NessusFedora Local Security Checks
low
51344Fedora 14 : mailman-2.1.13-6.fc14.1 (2010-14834)NessusFedora Local Security Checks
low
50469FreeBSD : Mailman -- XSS in web interface (4ab29e12-e787-11df-adfa-00e0815b8da8)NessusFreeBSD Local Security Checks
low
49738Mandriva Linux Security Advisory : mailman (MDVSA-2010:191)NessusMandriva Local Security Checks
low