CVE-2016-6893

Published on: 09/02/2016 12:00:00 AM UTC

Last Modified on: 03/23/2021 11:27:12 PM UTC

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Certain versions of Mailman from Gnu contain the following vulnerability:

Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account.

  • CVE-2016-6893 has been assigned by URL Logo [email protected] to track the vulnerability - currently rated as HIGH severity.

CVSS3 Score: 8.8 - HIGH

Attack
Vector
Attack
Complexity
Privileges
Required
User
Interaction
NETWORK LOW NONE REQUIRED
Scope Confidentiality
Impact
Integrity
Impact
Availability
Impact
UNCHANGED HIGH HIGH HIGH

CVSS2 Score: 6.8 - MEDIUM

Access
Vector
Access
Complexity
Authentication
NETWORK MEDIUM NONE
Confidentiality
Impact
Integrity
Impact
Availability
Impact
PARTIAL PARTIAL PARTIAL

CVE References

Description Tags Link
Mailman Access Control Flaw in User Options Page Lets Remote Users Conduct Cross-Site Request Forgery Attacks - SecurityTracker www.securitytracker.com
text/html
URL Logo SECTRACK 1036728
Bug #1614841 “CSRF protection needs to be extended to the user o...” : Bugs : GNU Mailman Issue Tracking
bugs.launchpad.net
text/html
URL Logo CONFIRM bugs.launchpad.net/bugs/1614841
Debian -- Security Information -- DSA-3668-1 mailman www.debian.org
Depreciated Link
text/html
URL Logo DEBIAN DSA-3668
GNU Mailman CVE-2016-6893 Cross Site Request Forgery Vulnerability cve.report (archive)
text/html
URL Logo BID 92731

Known Affected Configurations (CPE V2.3)

Type Vendor Product Version Update Edition Language
ApplicationGnuMailman2.1AllAllAll
ApplicationGnuMailman2.1.1AllAllAll
ApplicationGnuMailman2.1.10AllAllAll
ApplicationGnuMailman2.1.10rc1AllAll
ApplicationGnuMailman2.1.10b1AllAllAll
ApplicationGnuMailman2.1.10b3AllAllAll
ApplicationGnuMailman2.1.10b4AllAllAll
ApplicationGnuMailman2.1.11AllAllAll
ApplicationGnuMailman2.1.11rc1AllAll
ApplicationGnuMailman2.1.11rc2AllAll
ApplicationGnuMailman2.1.12AllAllAll
ApplicationGnuMailman2.1.12rc1AllAll
ApplicationGnuMailman2.1.12rc2AllAll
ApplicationGnuMailman2.1.13AllAllAll
ApplicationGnuMailman2.1.13rc1AllAll
ApplicationGnuMailman2.1.14AllAllAll
ApplicationGnuMailman2.1.14rc1AllAll
ApplicationGnuMailman2.1.14-1AllAllAll
ApplicationGnuMailman2.1.15AllAllAll
ApplicationGnuMailman2.1.15rc1AllAll
ApplicationGnuMailman2.1.16AllAllAll
ApplicationGnuMailman2.1.16rc1AllAll
ApplicationGnuMailman2.1.16rc2AllAll
ApplicationGnuMailman2.1.16rc3AllAll
ApplicationGnuMailman2.1.17AllAllAll
ApplicationGnuMailman2.1.18AllAllAll
ApplicationGnuMailman2.1.18rc1AllAll
ApplicationGnuMailman2.1.18rc2AllAll
ApplicationGnuMailman2.1.18rc3AllAll
ApplicationGnuMailman2.1.18-1AllAllAll
ApplicationGnuMailman2.1.19AllAllAll
ApplicationGnuMailman2.1.19rc1AllAll
ApplicationGnuMailman2.1.19rc2AllAll
ApplicationGnuMailman2.1.19rc3AllAll
ApplicationGnuMailman2.1.2AllAllAll
ApplicationGnuMailman2.1.20AllAllAll
ApplicationGnuMailman2.1.21AllAllAll
ApplicationGnuMailman2.1.21rc2AllAll
ApplicationGnuMailman2.1.22AllAllAll
ApplicationGnuMailman2.1.23AllAllAll
ApplicationGnuMailman2.1.3AllAllAll
ApplicationGnuMailman2.1.4AllAllAll
ApplicationGnuMailman2.1.5AllAllAll
ApplicationGnuMailman2.1.6AllAllAll
ApplicationGnuMailman2.1.8AllAllAll
ApplicationGnuMailman2.1.9AllAllAll
ApplicationGnuMailman2.1AllAllAll
ApplicationGnuMailman2.1.1AllAllAll
ApplicationGnuMailman2.1.10AllAllAll
ApplicationGnuMailman2.1.10rc1AllAll
ApplicationGnuMailman2.1.10b1AllAllAll
ApplicationGnuMailman2.1.10b3AllAllAll
ApplicationGnuMailman2.1.10b4AllAllAll
ApplicationGnuMailman2.1.11AllAllAll
ApplicationGnuMailman2.1.11rc1AllAll
ApplicationGnuMailman2.1.11rc2AllAll
ApplicationGnuMailman2.1.12AllAllAll
ApplicationGnuMailman2.1.12rc1AllAll
ApplicationGnuMailman2.1.12rc2AllAll
ApplicationGnuMailman2.1.13AllAllAll
ApplicationGnuMailman2.1.13rc1AllAll
ApplicationGnuMailman2.1.14AllAllAll
ApplicationGnuMailman2.1.14rc1AllAll
ApplicationGnuMailman2.1.14-1AllAllAll
ApplicationGnuMailman2.1.15AllAllAll
ApplicationGnuMailman2.1.15rc1AllAll
ApplicationGnuMailman2.1.16AllAllAll
ApplicationGnuMailman2.1.16rc1AllAll
ApplicationGnuMailman2.1.16rc2AllAll
ApplicationGnuMailman2.1.16rc3AllAll
ApplicationGnuMailman2.1.17AllAllAll
ApplicationGnuMailman2.1.18AllAllAll
ApplicationGnuMailman2.1.18rc1AllAll
ApplicationGnuMailman2.1.18rc2AllAll
ApplicationGnuMailman2.1.18rc3AllAll
ApplicationGnuMailman2.1.18-1AllAllAll
ApplicationGnuMailman2.1.19AllAllAll
ApplicationGnuMailman2.1.19rc1AllAll
ApplicationGnuMailman2.1.19rc2AllAll
ApplicationGnuMailman2.1.19rc3AllAll
ApplicationGnuMailman2.1.2AllAllAll
ApplicationGnuMailman2.1.20AllAllAll
ApplicationGnuMailman2.1.21AllAllAll
ApplicationGnuMailman2.1.21rc2AllAll
ApplicationGnuMailman2.1.22AllAllAll
ApplicationGnuMailman2.1.23AllAllAll
ApplicationGnuMailman2.1.3AllAllAll
ApplicationGnuMailman2.1.4AllAllAll
ApplicationGnuMailman2.1.5AllAllAll
ApplicationGnuMailman2.1.6AllAllAll
ApplicationGnuMailman2.1.8AllAllAll
ApplicationGnuMailman2.1.9AllAllAll
  • cpe:2.3:a:gnu:mailman:2.1:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.1:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.10:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.10:rc1:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.10b1:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.10b3:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.10b4:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.11:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.11:rc1:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.11:rc2:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.12:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.12:rc1:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.12:rc2:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.13:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.13:rc1:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.14:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.14:rc1:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.14-1:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.15:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.15:rc1:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.16:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.16:rc1:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.16:rc2:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.16:rc3:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.17:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.18:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.18:rc1:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.18:rc2:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.18:rc3:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.18-1:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.19:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.19:rc1:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.19:rc2:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.19:rc3:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.2:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.20:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.21:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.21:rc2:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.22:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.23:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.3:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.4:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.5:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.6:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.8:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.9:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.1:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.10:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.10:rc1:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.10b1:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.10b3:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.10b4:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.11:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.11:rc1:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.11:rc2:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.12:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.12:rc1:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.12:rc2:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.13:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.13:rc1:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.14:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.14:rc1:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.14-1:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.15:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.15:rc1:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.16:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.16:rc1:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.16:rc2:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.16:rc3:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.17:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.18:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.18:rc1:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.18:rc2:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.18:rc3:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.18-1:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.19:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.19:rc1:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.19:rc2:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.19:rc3:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.2:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.20:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.21:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.21:rc2:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.22:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.23:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.3:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.4:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.5:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.6:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.8:*:*:*:*:*:*:*:
  • cpe:2.3:a:gnu:mailman:2.1.9:*:*:*:*:*:*:*: