The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors.

A vulnerability has been discovered in the web interface of sympa, a mailing list manager. An attacker could take advantage of this flaw in the newsletter posting area, which allows sending to a list, or to oneself, any file located on the server filesystem and readable by the sympa user.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated sympa packages fix security vulnerability :

A vulnerability have been discovered in Sympa web interface that allows access to files on the server filesystem. This breach allows to send to a list or a user any file readable by the Sympa user, located on the server filesystem, using the Sympa web interface newsletter posting area (CVE-2015-1306).

The Sympa Project reports :

The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors.

A vulnerability has been discovered in the web interface of sympa, a mailing list manager. An attacker could take advantage of this flaw in the newsletter posting area, which allows sending to a list, or to oneself, any file located on the server filesystem and readable by the sympa user.

ID	Name	Product	Family	Severity
82131	Debian DLA-148-1 : sympa security update	Nessus	Debian Local Security Checks	medium
81934	Mandriva Linux Security Advisory : sympa (MDVSA-2015:051)	Nessus	Mandriva Local Security Checks	medium
81798	FreeBSD : sympa -- Remote attackers can read arbitrary files (451a6c79-c92b-11e4-a835-000c292ee6b8)	Nessus	FreeBSD Local Security Checks	medium
80872	Debian DSA-3134-1 : sympa - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2015-1306

high

Tenable Plugins

medium

medium

medium

medium