Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | Updated mailman packages fix multiple XSS vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | MDVSA-2008:061 | First vendor Publication | 2008-03-06 |
| Vendor | Mandriva | Last vendor Modification | 2008-03-06 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Multiple cross-site scripting (XSS) vulnerabilities were found in Mailman prior to version 2.1.10b1, which allow remote attackers to inject arbitrary web script or HTML via edting templates and the list's info attribute in the web administrator interface. The updated packages have been patched to correct these issues. |
Original Source
| Url : http://www.mandriva.com/security/advisories?name=MDVSA-2008:061 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:17558 | |||
| Oval ID: | oval:org.mitre.oval:def:17558 | ||
| Title: | USN-586-1 -- mailman vulnerability | ||
| Description: | Multiple cross-site scripting flaws were discovered in mailman. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-586-1 CVE-2008-0564 | Version: | 7 |
| Platform(s): | Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 | Product(s): | mailman |
| Definition Synopsis: | |||
| |||
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-07-30 | Name : CentOS Update for mailman CESA-2011:0307 centos5 x86_64 File : nvt/gb_CESA-2011_0307_mailman_centos5_x86_64.nasl |
| 2011-08-09 | Name : CentOS Update for mailman CESA-2011:0307 centos5 i386 File : nvt/gb_CESA-2011_0307_mailman_centos5_i386.nasl |
| 2011-03-07 | Name : CentOS Update for mailman CESA-2011:0307 centos4 i386 File : nvt/gb_CESA-2011_0307_mailman_centos4_i386.nasl |
| 2011-03-07 | Name : RedHat Update for mailman RHSA-2011:0307-01 File : nvt/gb_RHSA-2011_0307-01_mailman.nasl |
| 2010-05-12 | Name : Mac OS X 10.6.3 Update / Mac OS X Security Update 2010-002 File : nvt/macosx_upd_10_6_3_secupd_2010-002.nasl |
| 2009-10-13 | Name : SLES10: Security update for mailman File : nvt/sles10_mailman.nasl |
| 2009-10-10 | Name : SLES9: Security update for mailman File : nvt/sles9p5033420.nasl |
| 2009-04-09 | Name : Mandriva Update for mailman MDVSA-2008:061 (mailman) File : nvt/gb_mandriva_MDVSA_2008_061.nasl |
| 2009-03-23 | Name : Ubuntu Update for mailman vulnerability USN-586-1 File : nvt/gb_ubuntu_USN_586_1.nasl |
| 2009-02-16 | Name : Fedora Update for mailman FEDORA-2008-1334 File : nvt/gb_fedora_2008_1334_mailman_fc8.nasl |
| 2009-02-16 | Name : Fedora Update for mailman FEDORA-2008-1356 File : nvt/gb_fedora_2008_1356_mailman_fc7.nasl |
| 2008-09-04 | Name : FreeBSD Ports: ja-mailman, mailman, mailman-with-htdig File : nvt/freebsd_ja-mailman.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 41089 | Mailman Web Admin Interface List Info XSS |
| 41088 | Mailman Template Editing Unspecified XSS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2011-0307.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing a security update. File : sl_20110301_mailman_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
| 2011-03-03 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2011-0307.nasl - Type : ACT_GATHER_INFO |
| 2011-03-02 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2011-0307.nasl - Type : ACT_GATHER_INFO |
| 2010-03-29 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2010-002.nasl - Type : ACT_GATHER_INFO |
| 2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12224.nasl - Type : ACT_GATHER_INFO |
| 2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_mailman-080814.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Mandriva Linux host is missing a security update. File : mandriva_MDVSA-2008-061.nasl - Type : ACT_GATHER_INFO |
| 2008-08-22 | Name : The remote openSUSE host is missing a security update. File : suse_mailman-5518.nasl - Type : ACT_GATHER_INFO |
| 2008-08-20 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_mailman-5519.nasl - Type : ACT_GATHER_INFO |
| 2008-04-28 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_f47f274612c511ddbab70016179b2dd5.nasl - Type : ACT_GATHER_INFO |
| 2008-03-17 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-586-1.nasl - Type : ACT_GATHER_INFO |
| 2008-02-14 | Name : The remote Fedora host is missing a security update. File : fedora_2008-1334.nasl - Type : ACT_GATHER_INFO |
| 2008-02-14 | Name : The remote Fedora host is missing a security update. File : fedora_2008-1356.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:39:16 |
|
