Mailman Cross Site Scripting - Advisories

Mailman Cross Site Scripting

Secunia Advisory:	SA7949
Release Date:	2003-01-27
Last Update:	2003-01-28

Critical:	Moderately critical
Impact:	Cross Site Scripting
Where:	From remote
Solution Status:	Vendor Patch

Software:	Mailman 2.x

	Want to know the next time vulnerabilities are fixed in this product? - Companies can be alerted via email and SMS!

Description: Mailman does not handle certain input correctly, this allows users to perform Cross Site Scripting. http://server/mailman/options/yourlist? language=en&email=<SCRIPT>alert('test')</SCRIPT> http://server//mailman/options/yourlist? language=<SCRIPT>alert('test')</SCRIPT> This has only been confirmed in version 2.1 Solution: You ought to disable the webinterface temporarily or implement a firewall or proxy which can filter malicious characters from requests. A patch called xss-2.1.0-patch.txt is available: http://sourceforge.net/project/showfiles.php?group_id=103 This issue will be fixed in version 2.1.1. Provided and/or discovered by: Manuel Rodriguez



Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

9 Related Secunia Security Advisories

1. Mailman Script Insertion Vulnerability

Send Feedback to Secunia

If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.

Secunia PSI
Scan | Patch | Track
Free Download

Secunia Poll

Most Popular Advisories

1.	Mozilla Firefox Multiple Vulnerabilities

2.	Opera for Windows Unspecified Code Execution

3.	VLC Media Player WAV Processing Integer Overflow

4.	Mozilla Thunderbird Multiple Vulnerabilities

5.	Opera Canvas Functions Information Disclosure

6.	zlib Denial of Service Vulnerability

7.	UnixWare ReliantHA Privilege Escalation Vulnerabilities

8.	PCRE pcre_compile.c Buffer Overflow Vulnerability

9.	GNOME Glib PCRE pcre_compile.c Buffer Overflow Vulnerability

10.	Drupal Outline Designer Security Bypass