CVE-2021-43332: CSRF
In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-43332.
What is the severity of CVE-2021-43332?
The severity of CVE-2021-43332 is medium with a CVSS score of 6.5.
Which software versions are affected by CVE-2021-43332?
GNU Mailman versions before 2.1.36 and Debian Debian Linux version 9.0 are affected by CVE-2021-43332.
What is the description of CVE-2021-43332?
CVE-2021-43332 is a vulnerability in GNU Mailman before 2.1.36 where the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password, which could be cracked by a moderator via an offline brute-force attack.
How can the vulnerability in CVE-2021-43332 be exploited?
CVE-2021-43332 can be exploited by a moderator launching an offline brute-force attack to crack the encrypted version of the list admin password contained in the CSRF token for the Cgi/admindb.py admindb page.