← volver
CVE-2021-40347

CVE-2021-40347

EPSS 1.1%
An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.
Productos afectados
n/a · n/a

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →
Referencias
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993746https://gitlab.com/mailman/postorius/-/commit/3d880c56b58bc26b32eac0799407d74b64b7474bhttps://gitlab.com/mailman/postorius/-/issues/531https://gitlab.com/mailman/postorius/-/tagshttps://phabricator.wikimedia.org/T289798https://www.debian.org/security/2021/dsa-4970