CVE-2021-42096

Published: Oct 21, 2021Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin password, and may be useful in conducting a brute-force attack against that password.

Affected (2)

Products: Gnu: Mailman · Debian: Debian Linux

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gnu Mailman	Before 2.1.35

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Related CWEs

CWE-307

Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

References (8)

http://www.openwall.com/lists/oss-security/2021/10/21/4

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

https://bugs.launchpad.net/mailman/+bug/1947639

Source: cve@mitre.org

PatchThird Party Advisory

https://mail.python.org/archives/list/mailman-announce%40python.org/thread/IKCO6JU755AP5G5TKMBJL6IEZQTTNPDQ/

Source: cve@mitre.org

https://www.debian.org/security/2021/dsa-4991

Source: cve@mitre.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2021/10/21/4

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchThird Party Advisory

https://bugs.launchpad.net/mailman/+bug/1947639

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://mail.python.org/archives/list/mailman-announce%40python.org/thread/IKCO6JU755AP5G5TKMBJL6IEZQTTNPDQ/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.debian.org/security/2021/dsa-4991

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.