{"schemaVersion":3,"id":"CVE-2010-3089","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Multiple cross-site scripting (XSS) vulnerabilities in GNU Mailman before 2.1.14rc1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving (1) the list information field or (2) the list description field.","dates":{"published":"2010-09-15T19:00:00.000Z","modified":"2024-08-07T02:55:46.792Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":3.5,"severity":"low","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":3.5,"severity":"low","vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01973,"percentile":0.8011,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.01973},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01973,"percentile":0.8011}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01973,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01973,"percentile":0.8011}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"gnu","product":"mailman","name":"mailman","label":"mailman","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.1.13","noFixRecorded":false,"fixedIn":null},{"text":"2.1","noFixRecorded":false,"fixedIn":null},{"text":"2.1:alpha","noFixRecorded":false,"fixedIn":null},{"text":"2.1:beta","noFixRecorded":false,"fixedIn":null},{"text":"2.1:stable","noFixRecorded":false,"fixedIn":null},{"text":"2.1.1","noFixRecorded":false,"fixedIn":null},{"text":"2.1.2","noFixRecorded":false,"fixedIn":null},{"text":"2.1.3","noFixRecorded":false,"fixedIn":null},{"text":"2.1.4","noFixRecorded":false,"fixedIn":null},{"text":"2.1.5","noFixRecorded":false,"fixedIn":null},{"text":"2.1.6","noFixRecorded":false,"fixedIn":null},{"text":"2.1.7","noFixRecorded":false,"fixedIn":null},{"text":"2.1.8","noFixRecorded":false,"fixedIn":null},{"text":"2.1.9","noFixRecorded":false,"fixedIn":null},{"text":"2.1.10","noFixRecorded":false,"fixedIn":null},{"text":"2.1.11","noFixRecorded":false,"fixedIn":null},{"text":"2.1.11:rc1","noFixRecorded":false,"fixedIn":null},{"text":"2.1.11:rc2","noFixRecorded":false,"fixedIn":null},{"text":"2.1.12","noFixRecorded":false,"fixedIn":null},{"text":"2.1.13:rc1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.1.13 | 2.1 | 2.1:alpha | 2.1:beta | 2.1:stable | 2.1.1 | 2.1.2 | 2.1.3 | 2.1.4 | 2.1.5 | 2.1.6 | 2.1.7 | 2.1.8 | 2.1.9 | 2.1.10 | 2.1.11 | 2.1.11:rc1 | 2.1.11:rc2 | 2.1.12 | 2.1.13:rc1","eol":null,"hubHref":"/vendor/gnu/mailman"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://marc.info/?l=oss-security&m=128438736513097&w=2","label":"marc.info?l=oss-security&m=128438736513097&w=2","hostname":"marc.info","tags":["Mailing List","X Refsource MLIST"]},{"url":"http://www.redhat.com/support/errata/RHSA-2011-0307.html","label":"www.redhat.com/support/errata/RHSA-2011-0307.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://marc.info/?l=oss-security&m=128441369020123&w=2","label":"marc.info?l=oss-security&m=128441369020123&w=2","hostname":"marc.info","tags":["Mailing List","X Refsource MLIST"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052297.html","label":"lists.fedoraproject.org/pipermail/package-announce/2010-December/052297.html","hostname":"lists.fedoraproject.org","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"http://secunia.com/advisories/43294","label":"secunia.com/advisories/43294","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html","label":"lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE"]},{"url":"http://www.vupen.com/english/advisories/2011/0460","label":"www.vupen.com/english/advisories/2011/0460","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://lists.opensuse.org/opensuse-updates/2011-05/msg00000.html","label":"lists.opensuse.org/opensuse-updates/2011-05/msg00000.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE"]},{"url":"http://www.debian.org/security/2011/dsa-2170","label":"www.debian.org/security/2011/dsa-2170","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052312.html","label":"lists.fedoraproject.org/pipermail/package-announce/2010-December/052312.html","hostname":"lists.fedoraproject.org","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"http://secunia.com/advisories/42502","label":"secunia.com/advisories/42502","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://marc.info/?l=oss-security&m=128441135117819&w=2","label":"marc.info?l=oss-security&m=128441135117819&w=2","hostname":"marc.info","tags":["Mailing List","X Refsource MLIST"]},{"url":"https://launchpad.net/mailman/+milestone/2.1.14rc1","label":"launchpad.net/mailman/+milestone/2.1.14rc1","hostname":"launchpad.net","tags":["X Refsource CONFIRM"]},{"url":"http://www.ubuntu.com/usn/USN-1069-1","label":"www.ubuntu.com/usn/USN-1069-1","hostname":"www.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU"]},{"url":"http://www.redhat.com/support/errata/RHSA-2011-0308.html","label":"www.redhat.com/support/errata/RHSA-2011-0308.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html","label":"lists.apple.com/archives/security-announce/2011/Mar/msg00006.html","hostname":"lists.apple.com","tags":["Vendor Advisory","X Refsource APPLE"]},{"url":"http://marc.info/?l=oss-security&m=128440851513718&w=2","label":"marc.info?l=oss-security&m=128440851513718&w=2","hostname":"marc.info","tags":["Mailing List","X Refsource MLIST"]},{"url":"http://secunia.com/advisories/41265","label":"secunia.com/advisories/41265","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2011/0436","label":"www.vupen.com/english/advisories/2011/0436","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://mail.python.org/pipermail/mailman-announce/2010-September/000151.html","label":"mail.python.org/pipermail/mailman-announce/2010-September/000151.html","hostname":"mail.python.org","tags":["Mailing List","X Refsource MLIST"]},{"url":"http://www.vupen.com/english/advisories/2010/3271","label":"www.vupen.com/english/advisories/2010/3271","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://marc.info/?l=oss-security&m=128441237618793&w=2","label":"marc.info?l=oss-security&m=128441237618793&w=2","hostname":"marc.info","tags":["Mailing List","X Refsource MLIST"]},{"url":"http://secunia.com/advisories/43425","label":"secunia.com/advisories/43425","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.vupen.com/english/advisories/2011/0542","label":"www.vupen.com/english/advisories/2011/0542","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=631881","label":"bugzilla.redhat.com/show_bug.cgi?id=631881","hostname":"bugzilla.redhat.com","tags":["X Refsource CONFIRM"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=631859","label":"bugzilla.redhat.com/show_bug.cgi?id=631859","hostname":"bugzilla.redhat.com","tags":["X Refsource CONFIRM"]},{"url":"http://secunia.com/advisories/43580","label":"secunia.com/advisories/43580","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://mail.python.org/pipermail/mailman-announce/2010-September/000150.html","label":"mail.python.org/pipermail/mailman-announce/2010-September/000150.html","hostname":"mail.python.org","tags":["Mailing List","X Refsource MLIST"]},{"url":"http://secunia.com/advisories/43549","label":"secunia.com/advisories/43549","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://support.apple.com/kb/HT4581","label":"support.apple.com/kb/HT4581","hostname":"support.apple.com","tags":["X Refsource CONFIRM"]}],"lineage":{"upstream":[],"downstream":["DSA-2170-1","RHSA-2011:0307","RHSA-2011:0308"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2010-09-15T19:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T02:55:46.792Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":14,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T10:13:24.684Z","stale":false,"partial":false}}