GNU Mailman Admin Login Cross-Site Scripting Vulnerability

Bugtraq ID:	4825
Class:	Input Validation Error
CVE:	CVE-2002-0388
Remote:	Yes
Local:	No
Published:	May 20 2002 12:00AM
Updated:	Jul 11 2009 12:46PM
Credit:	Discovery of this issue is credited to "office".
Vulnerable:	GNU Mailman 2.0.11 + Debian Linux 3.0 GNU Mailman 2.0.10 GNU Mailman 2.0.9 GNU Mailman 2.0.8 + Redhat Linux 7.3 i386 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 - Redhat PowerTools 7.1 - Redhat PowerTools 7.0 GNU Mailman 2.0.7 GNU Mailman 2.0.6 GNU Mailman 2.0.5 - Debian Linux 2.2 sparc - Debian Linux 2.2 powerpc - Debian Linux 2.2 arm - Debian Linux 2.2 alpha - Debian Linux 2.2 68k - Debian Linux 2.2 - FreeBSD FreeBSD 4.3 - HP HP-UX 11.11 - HP HP-UX 11.0 - HP HP-UX 10.20 - Mandriva Linux Mandrake 8.0 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.1 - NetBSD NetBSD 1.5.2 - NetBSD NetBSD 1.5.1 - OpenBSD OpenBSD 2.9 - OpenBSD OpenBSD 2.8 - OpenBSD OpenBSD 2.7 - Redhat Linux 7.1 - Redhat Linux 7.0 - Slackware Linux 8.0 - Slackware Linux 7.1 - Slackware Linux 7.0 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 - SuSE Linux 7.2 - SuSE Linux 7.1 - SuSE Linux 7.0 GNU Mailman 2.0.4 GNU Mailman 2.0.3 GNU Mailman 2.0.2 GNU Mailman 2.0.1 GNU Mailman 2.0 GNU Mailman 1.1 + Debian Linux 2.2 sparc + Debian Linux 2.2 powerpc + Debian Linux 2.2 IA-32 + Debian Linux 2.2 arm + Debian Linux 2.2 alpha + Debian Linux 2.2 68k + Debian Linux 2.2
Not Vulnerable:	GNU Mailman 2.0.12 GNU Mailman 2.0.11 + Debian Linux 3.0

GNU Mailman Admin Login Cross-Site Scripting Vulnerability

GNU Mailman is prone to a cross-site scripting vulnerability. An attacker may construct a malicious link to the administrative login page, which contains arbitrary HTML and script code.

A user visiting the link will have the attacker's script code executed in their web browser in the context of the site running the vulnerable software.