In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - mailman: XSS in Cgi/options.py via crafted URL (CVE-2021-43331)

  - mailman: a list moderator can crack the list admin password encrypted in a CSRF token (CVE-2021-43332)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The version of mailman installed on the remote host is prior to 2.1.15-30. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2370 advisory.

    In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary     JavaScript for XSS. (CVE-2021-43331)

    In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted     version of the list admin password. This could potentially be cracked by a moderator via an offline brute-     force attack. (CVE-2021-43332)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5151-2 advisory.

    USN-5151-1 fixed several vulnerabilities in Mailman. This update provides the corresponding update for     Ubuntu 20.04 ESM.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3049 advisory.

  - In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary     JavaScript for XSS. (CVE-2021-43331)

  - In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted     version of the list admin password. This could potentially be cracked by a moderator via an offline brute-     force attack. (CVE-2021-43332)

  - In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request     (using that token) to set a new admin password or make other changes. (CVE-2021-44227)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1886-1 advisory.

  - GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived     from the admin password, and may be useful in conducting a brute-force attack against that password.
    (CVE-2021-42096)

  - In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary     JavaScript for XSS. (CVE-2021-43331)

  - In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted     version of the list admin password. This could potentially be cracked by a moderator via an offline brute-     force attack. (CVE-2021-43332)

  - In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request     (using that token) to set a new admin password or make other changes. (CVE-2021-44227)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the mailman package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary     JavaScript for XSS. (CVE-2021-43331)

  - In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted     version of the list admin password. This could potentially be cracked by a moderator via an offline brute-     force attack. (CVE-2021-43332)

  - In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request     (using that token) to set a new admin password or make other changes. (CVE-2021-44227)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 ESM / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5151-1 advisory.

    It was discovered that Mailman incorrectly handled certain URL. An attacker could possibly use this issue     to execute arbitrary code. (CVE-2021-43331)

    It was discovered that Mailman incorrectly handled certain inputs. An attacker could possibly use this     issue to expose sensitive information. (CVE-2021-43332)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198433	RHEL 8 : mailman (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
195544	RHEL 7 : mailman (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium
186562	Amazon Linux 2 : mailman (ALAS-2023-2370)	Nessus	Amazon Linux Local Security Checks	medium
183591	Ubuntu 20.04 ESM : Mailman vulnerabilities (USN-5151-2)	Nessus	Ubuntu Local Security Checks	medium
161990	Debian DLA-3049-1 : mailman - LTS security update	Nessus	Debian Local Security Checks	high
161744	SUSE SLES12 Security Update : mailman (SUSE-SU-2022:1886-1)	Nessus	SuSE Local Security Checks	high
161572	EulerOS 2.0 SP3 : mailman (EulerOS-SA-2022-1745)	Nessus	Huawei Local Security Checks	high
155602	Ubuntu 16.04 ESM / 18.04 LTS : Mailman vulnerabilities (USN-5151-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2021-43332

medium

Tenable Plugins

medium

medium

medium

medium

high

high

high

medium