GHSA-xq58-69h2-765mHighCVSS 8.8

Cross Site Request Forgery in mailman

Published
December 16, 2021
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2021-44227 →

📋 Description

In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.

🎯 Affected products1

  • pip/mailman:< 2.1.38

🔗 References (4)