GNU Mailman 'email' Cross Site Scripting Vulnerability
BID:6677
Info
GNU Mailman 'email' Cross Site Scripting Vulnerability
| Bugtraq ID: | 6677 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 24 2003 12:00AM |
| Updated: | Jan 24 2003 12:00AM |
| Credit: | The discovery of this vulnerability has been credited to <[email protected]>. |
| Vulnerable: |
GNU Mailman 2.1 |
| Not Vulnerable: |
GNU Mailman 2.1.1 |
Discussion
GNU Mailman 'email' Cross Site Scripting Vulnerability
A vulnerability has been discovered in GNU Mailman. It has been reported that Mailman is prone to cross site scripting attacks. This is due to insufficient santization of URI parameters.
As a result, attackers may embed malicious script code or HTML into a link to a site running the vulnerable software. If such a link is followed, the attacker-supplied code will be interpreted in the web browser of the victim of the attack. It may be possible to steal the unsuspecting user's cookie-based authentication credentials, as well as other sensitive information. Other attacks are also possible.
A vulnerability has been discovered in GNU Mailman. It has been reported that Mailman is prone to cross site scripting attacks. This is due to insufficient santization of URI parameters.
As a result, attackers may embed malicious script code or HTML into a link to a site running the vulnerable software. If such a link is followed, the attacker-supplied code will be interpreted in the web browser of the victim of the attack. It may be possible to steal the unsuspecting user's cookie-based authentication credentials, as well as other sensitive information. Other attacks are also possible.
References
GNU Mailman 'email' Cross Site Scripting Vulnerability
References:
References: