CVE-2010-3089

Published: Sep 15, 2010Modified: Apr 29, 2026

3.5

Vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability: 6.8 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in GNU Mailman before 2.1.14rc1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving (1) the list information field or (2) the list description field.

Affected (20)

Products: Gnu: Mailman

Gnu

1 product

Mailman

Configuration A

20 vulnerable

Vulnerable Software	Affected Versions
Gnu Mailman	Up to 2.1.13
Gnu Mailman	Version 2.1.10
Gnu Mailman	Version 2.1.11
Gnu Mailman	Version 2.1.11 rc1
Gnu Mailman	Version 2.1.11 rc2
Gnu Mailman	Version 2.1.12
Gnu Mailman	Version 2.1.13 rc1
Gnu Mailman	Version 2.1.1
Gnu Mailman	Version 2.1.2
Gnu Mailman	Version 2.1.3
Gnu Mailman	Version 2.1.4
Gnu Mailman	Version 2.1.5
Gnu Mailman	Version 2.1.6
Gnu Mailman	Version 2.1.7
Gnu Mailman	Version 2.1.8
Gnu Mailman	Version 2.1.9
Gnu Mailman	Version 2.1
Gnu Mailman	Version 2.1 alpha
Gnu Mailman	Version 2.1 beta
Gnu Mailman	Version 2.1 stable

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (60)

http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052297.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052312.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2011-05/msg00000.html

Source: secalert@redhat.com

http://mail.python.org/pipermail/mailman-announce/2010-September/000150.html

Source: secalert@redhat.com

http://mail.python.org/pipermail/mailman-announce/2010-September/000151.html

Source: secalert@redhat.com

http://marc.info/?l=oss-security&m=128438736513097&w=2

Source: secalert@redhat.com

http://marc.info/?l=oss-security&m=128440851513718&w=2

Source: secalert@redhat.com

http://marc.info/?l=oss-security&m=128441135117819&w=2

Source: secalert@redhat.com

http://marc.info/?l=oss-security&m=128441237618793&w=2

Source: secalert@redhat.com

http://marc.info/?l=oss-security&m=128441369020123&w=2

Source: secalert@redhat.com

http://secunia.com/advisories/41265

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/42502

Source: secalert@redhat.com

http://secunia.com/advisories/43294

Source: secalert@redhat.com

http://secunia.com/advisories/43425

Source: secalert@redhat.com

http://secunia.com/advisories/43549

Source: secalert@redhat.com

http://secunia.com/advisories/43580

Source: secalert@redhat.com

http://support.apple.com/kb/HT4581

Source: secalert@redhat.com

http://www.debian.org/security/2011/dsa-2170

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2011-0307.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2011-0308.html

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1069-1

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2010/3271

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0436

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0460

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0542

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=631859

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=631881

Source: secalert@redhat.com

https://launchpad.net/mailman/+milestone/2.1.14rc1

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html