CVE-2016-6893

high-risk

Published 2016-09-02

Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account.

Do I need to act?

0.34% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (20)

Mailman

Affected Vendors

Gnu

References (8)

http://www.debian.org/security/2016/dsa-3668

http://www.securityfocus.com/bid/92731

http://www.securitytracker.com/id/1036728

Issue Tracking https://bugs.launchpad.net/bugs/1614841

http://www.debian.org/security/2016/dsa-3668

http://www.securityfocus.com/bid/92731

http://www.securitytracker.com/id/1036728

Issue Tracking https://bugs.launchpad.net/bugs/1614841

/ 100

high-risk

Severity 30/34 · Critical

Exploitability 1/34 · Minimal

Exposure 25/34 · High