Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - mailman: directory traversal in MTA transports that deliver programmatically (CVE-2015-2775)

  - mailman: Missing CSRF protection in admin web interface (CVE-2016-7123)

  - Pipermail in Mailman stores private mail messages with predictable filenames in a world-executable     directory, which allows local users to read private mailing list archives. (CVE-2002-0389)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote NewStart CGSL host, running version MAIN 4.05, has mailman packages installed that are affected by a vulnerability:

  - A cross-site scripting (XSS) flaw was found in mailman.
    An attacker, able to trick the user into visiting a     specific URL, can execute arbitrary web scripts on the     user's side and force the victim to perform unintended     actions. (CVE-2018-5950)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 5.04, has mailman packages installed that are affected by a vulnerability:

  - A cross-site scripting (XSS) flaw was found in mailman.
    An attacker, able to trick the user into visiting a     specific URL, can execute arbitrary web scripts on the     user's side and force the victim to perform unintended     actions. (CVE-2018-5950)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for mailman fixes the following issues :

Fixed a XSS vulnerability and information leak in user options CGI, which could be used to execute arbitrary scripts in the user's browser via specially encoded URLs (bsc#1077358 CVE-2018-5950)

Fixed a directory traversal vulnerability in MTA transports when using the recommended Mailman Transport for Exim (bsc#925502 CVE-2015-2775)

Fixed a XSS vulnerability, which allowed malicious listowners to inject scripts into the listinfo pages (bsc#1099510 CVE-2018-0618)

Fixed arbitrary text injection vulnerability in several mailman CGIs (CVE-2018-13796 bsc#1101288)

Fixed a CSRF vulnerability on the user options page (CVE-2016-6893 bsc#995352)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for mailman fixes the following security vulnerabilities :

Fixed a XSS vulnerability and information leak in user options CGI, which could be used to execute arbitrary scripts in the user's browser via specially encoded URLs (bsc#1077358 CVE-2018-5950)

Fixed a directory traversal vulnerability in MTA transports when using the recommended Mailman Transport for Exim (bsc#925502 CVE-2015-2775)

Fixed a XSS vulnerability, which allowed malicious listowners to inject scripts into the listinfo pages (bsc#1099510 CVE-2018-0618)

Fixed arbitrary text injection vulnerability in several mailman CGIs (CVE-2018-13796 bsc#1101288)

Fixed a CSRF vulnerability on the user options page (CVE-2016-6893 bsc#995352)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the mailman package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Mailman is software to help manage email discussion     lists, much like Majordomo and Smartmail. Unlike most     similar products, Mailman gives each mailing list a     webpage, and allows users to subscribe,unsubscribe,     etc. over the Web. Even the list manager can administer     his or her list entirely from the Web. Mailman also     integrates most things people want to do with mailing     lists, including archiving, mail news gateways, and so     on.

  - Security fix(es):

  - Cross-site scripting (XSS) vulnerability in the web UI     in Mailman before 2.1.26 allows remote attackers to     inject arbitrary web or HTML via a user-options     URL.(CVE-2018-5980)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Cross-site scripting (XSS) vulnerability in web UI

A cross-site scripting (XSS) flaw was found in mailman. An attacker, able to trick the user into visiting a specific URL, can execute arbitrary web scripts on the user's side and force the victim to perform unintended actions. (CVE-2018-5950)

Cross-site scripting (XSS) vulnerability in web UI

A cross-site scripting (XSS) flaw was found in mailman. An attacker, able to trick the user into visiting a specific URL, can execute arbitrary web scripts on the user's side and force the victim to perform unintended actions. (CVE-2018-5950)

CSRF protection missing in the user options page

Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account. (CVE-2016-6893)

This update for mailman fixes the following issues :

Security issue fixed :

  - CVE-2018-5950: Fixed XSS vulnerability via crafted URL     that could allow arbitrary JavaScript execution inside     the user's browser (boo#1077358).

Fix for CVE-2016-6893

----

Security fix for CVE-2018-5950

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for mailman is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mailman is a program used to help manage e-mail discussion lists.

Security Fix(es) :

* mailman: Cross-site scripting (XSS) vulnerability in web UI (CVE-2018-5950)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

An update for mailman is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mailman is a program used to help manage e-mail discussion lists.

Security Fix(es) :

* mailman: Cross-site scripting (XSS) vulnerability in web UI (CVE-2018-5950)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Security Fix(es) :

  - mailman: Cross-site scripting (XSS) vulnerability in web     UI (CVE-2018-5950)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:0504 advisory.

    Mailman is a program used to help manage e-mail discussion lists.

    Security Fix(es):

    * mailman: Cross-site scripting (XSS) vulnerability in web UI (CVE-2018-5950)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2018-0505 advisory.

    [3:2.1.15-26.1]
    - Related: #1545974 - Add import regular expression module

    [3:2.1.15-26]
    - Related: #1545974 - Bump release to make it higher than 7.5

    [3:2.1.15-24.2]
    - Resolves: #1545974 -  Add sanitizer to mitigate XSS injection

    [3:2.1.15-24.1]
    - Resolves: #1545974 -  Fix XSS vulnerability in web UI

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2018-0504 advisory.

    [3:2.1.12-26.3]
    - Related: #1545967 - Add missed import

    [3:2.1.12-26.2]
    - Resolves: #1545967 - Fix XSS vulnerability in web UI. Add sanitizer

    [3:2.1.12-26.1]
    - Resolves: #1545967 - Fix XSS vulnerability in web UI

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Calum Hutton and the Mailman team discovered a cross site scripting and information leak vulnerability in the user options page. A remote attacker could use a crafted URL to steal cookie information or to fish for whether a user is subscribed to a list with a private roster.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3563-1 advisory.

    It was discovered that Mailman incorrectly handled certain web scripts. An attacker could possibly use     this to inject arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Mark Sapiro reports :

An XSS vulnerability in the user options CGI could allow a crafted URL to execute arbitrary JavaScript in a user's browser. A related issue could expose information on a user's options page without requiring login.

The mailman package has a Cross-site scripting (XSS) vulnerability in the web UI before 2.1.26 which allows remote attackers to inject arbitrary web script or HTML via a user-options URL

For Debian 7 'Wheezy', these problems have been fixed in version 1:2.1.15-1+deb7u3

We recommend that you upgrade your mailman packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198363	RHEL 5 : mailman (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195540	RHEL 5 : mailman (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
127368	NewStart CGSL MAIN 4.05 : mailman Vulnerability (NS-SA-2019-0122)	Nessus	NewStart CGSL Local Security Checks	medium
127153	NewStart CGSL MAIN 5.04 : mailman Vulnerability (NS-SA-2019-0008)	Nessus	NewStart CGSL Local Security Checks	medium
121005	SUSE SLES11 Security Update : mailman (SUSE-SU-2019:13924-1)	Nessus	SuSE Local Security Checks	high
119955	SUSE SLES12 Security Update : mailman (SUSE-SU-2018:4296-1)	Nessus	SuSE Local Security Checks	high
109485	EulerOS 2.0 SP2 : mailman (EulerOS-SA-2018-1087)	Nessus	Huawei Local Security Checks	medium
109484	EulerOS 2.0 SP1 : mailman (EulerOS-SA-2018-1086)	Nessus	Huawei Local Security Checks	medium
109138	Amazon Linux 2 : mailman (ALAS-2018-985)	Nessus	Amazon Linux Local Security Checks	medium
108848	Amazon Linux AMI : mailman (ALAS-2018-985)	Nessus	Amazon Linux Local Security Checks	high
108631	openSUSE Security Update : mailman (openSUSE-2018-304)	Nessus	SuSE Local Security Checks	medium
108424	Fedora 27 : 3:mailman (2018-55b7018374)	Nessus	Fedora Local Security Checks	high
108340	CentOS 7 : mailman (CESA-2018:0505)	Nessus	CentOS Local Security Checks	medium
108339	CentOS 6 : mailman (CESA-2018:0504)	Nessus	CentOS Local Security Checks	medium
108334	Scientific Linux Security Update : mailman on SL7.x x86_64 (20180313)	Nessus	Scientific Linux Local Security Checks	medium
108333	Scientific Linux Security Update : mailman on SL6.x i386/x86_64 (20180313)	Nessus	Scientific Linux Local Security Checks	medium
108328	RHEL 7 : mailman (RHSA-2018:0505)	Nessus	Red Hat Local Security Checks	medium
108327	RHEL 6 : mailman (RHSA-2018:0504)	Nessus	Red Hat Local Security Checks	medium
108319	Oracle Linux 7 : mailman (ELSA-2018-0505)	Nessus	Oracle Linux Local Security Checks	medium
108318	Oracle Linux 6 : mailman (ELSA-2018-0504)	Nessus	Oracle Linux Local Security Checks	medium
106726	Debian DSA-4108-1 : mailman - security update	Nessus	Debian Local Security Checks	medium
106709	Ubuntu 14.04 LTS / 16.04 LTS : Mailman vulnerability (USN-3563-1)	Nessus	Ubuntu Local Security Checks	medium
106699	FreeBSD : Mailman -- XSS (XSS) vulnerability in the web UI (3d0eeef8-0cf9-11e8-99b0-d017c2987f9a)	Nessus	FreeBSD Local Security Checks	medium
106696	Debian DLA-1272-1 : mailman security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2018-5950

medium

Tenable Plugins

high

high

medium

medium

high

high

medium

medium

medium

high

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium