CVE-2016-6893

Published: Sep 2, 2016Modified: May 6, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account.

Affected (46)

Products: Gnu: Mailman

Gnu

1 product

Mailman

Configuration A

46 vulnerable

Vulnerable Software	Affected Versions
Gnu Mailman	Version 2.1.10
Gnu Mailman	Version 2.1.10 rc1
Gnu Mailman	Version 2.1.10b1
Gnu Mailman	Version 2.1.10b3
Gnu Mailman	Version 2.1.10b4
Gnu Mailman	Version 2.1.11
Gnu Mailman	Version 2.1.11 rc1
Gnu Mailman	Version 2.1.11 rc2
Gnu Mailman	Version 2.1.12
Gnu Mailman	Version 2.1.12 rc1
Gnu Mailman	Version 2.1.12 rc2
Gnu Mailman	Version 2.1.13
Gnu Mailman	Version 2.1.13 rc1
Gnu Mailman	Version 2.1.14-1
Gnu Mailman	Version 2.1.14
Gnu Mailman	Version 2.1.14 rc1
Gnu Mailman	Version 2.1.15
Gnu Mailman	Version 2.1.15 rc1
Gnu Mailman	Version 2.1.16
Gnu Mailman	Version 2.1.16 rc1
Gnu Mailman	Version 2.1.16 rc2
Gnu Mailman	Version 2.1.16 rc3
Gnu Mailman	Version 2.1.17
Gnu Mailman	Version 2.1.18-1
Gnu Mailman	Version 2.1.18
Gnu Mailman	Version 2.1.18 rc1
Gnu Mailman	Version 2.1.18 rc2
Gnu Mailman	Version 2.1.18 rc3
Gnu Mailman	Version 2.1.19
Gnu Mailman	Version 2.1.19 rc1
Gnu Mailman	Version 2.1.19 rc2
Gnu Mailman	Version 2.1.19 rc3
Gnu Mailman	Version 2.1.1
Gnu Mailman	Version 2.1.20
Gnu Mailman	Version 2.1.21
Gnu Mailman	Version 2.1.21 rc2
Gnu Mailman	Version 2.1.22
Gnu Mailman	Version 2.1.23
Gnu Mailman	Version 2.1.2
Gnu Mailman	Version 2.1.3
Gnu Mailman	Version 2.1.4
Gnu Mailman	Version 2.1.5
Gnu Mailman	Version 2.1.6
Gnu Mailman	Version 2.1.8
Gnu Mailman	Version 2.1.9
Gnu Mailman	Version 2.1