GHSA-v83x-78q3-gr2jMediumCVSS 5.4

GNU Mailman Postorius Access Control Issues

Published
May 24, 2022
Last Modified
October 21, 2024

🔗 CVE IDs covered (1)

CVE-2021-40347 →

📋 Description

An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.

🎯 Affected products1

  • pip/postorius:< 1.3.5

🔗 References (9)