CVE-2011-0707: gnu mailman Cross-site Scripting

CVSS: 4.3v2.0MediumModified

Published 22-02-2011Last modified 06-08-2024

Vulnerability summary

CVE-2011-0707 is a medium (CVSS 4.3) Cross-site Scripting vulnerability in gnu mailman. EPSS estimates a 4.25% chance of exploitation in the next 30 days, higher than 90.9% of scored vulnerabilities.

Overall risk

18/100

0100

Low · default modelHow is this calculated?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

4.25%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 1

DSA-2170-1 OPENSUSE-SU-2024:10215-1 RHSA-2011:0307 RHSA-2011:0308

Timeline

22-02-2011
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) username field in a confirmation message.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

4.25%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

0.00 pp

From 4.25% on 18-09-2026

18-09-202618-10-2026

EPSS score

4.25%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Gnu1 product

mailman≤ 2.1.14 | 1.0 | 1.1 | 2.0 | 2.0:beta3 | 2.0:beta4 | 2.0:beta5 | 2.0.1 | 2.0.2 | 2.0.3 | 2.0.4 | 2.0.5 | 2.0.6 | 2.0.7 | 2.0.8 | 2.0.9 | 2.0.10 | 2.0.11 | 2.0.12 | 2.0.13 | 2.0.14 | 2.1 | 2.1:alpha | 2.1:beta | 2.1:stable | 2.1.1 | 2.1.1:beta1 | 2.1.2 | 2.1.3 | 2.1.4 | 2.1.5 | 2.1.5.8 | 2.1.6 | 2.1.7 | 2.1.8 | 2.1.9 | 2.1.10 | 2.1.11 | 2.1.11:rc1 | 2.1.11:rc2 | 2.1.12 | 2.1.13 | 2.1.13:rc1 | 2.1.14:rc1 | 2.1b1

1 vendor · 1 product

References

30 links

www.vupen.com/english/advisories/2011/0487VDB EntryX Refsource VUPEN
lists.fedoraproject.org/pipermail/package-announce/2011-March/056387.htmlVendor AdvisoryX Refsource FEDORA
www.redhat.com/support/errata/RHSA-2011-0307.htmlVendor AdvisoryX Refsource REDHAT
osvdb.org/70936VDB EntryX Refsource OSVDB
secunia.com/advisories/43294Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vupen.com/english/advisories/2011/0720VDB EntryX Refsource VUPEN
lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.htmlVendor AdvisoryX Refsource SUSE
www.vupen.com/english/advisories/2011/0435VDB EntryX Refsource VUPENVendor Advisory
www.vupen.com/english/advisories/2011/0460VDB EntryX Refsource VUPENVendor Advisory
lists.opensuse.org/opensuse-updates/2011-05/msg00000.htmlVendor AdvisoryX Refsource SUSE

Show all 30 references

www.debian.org/security/2011/dsa-2170Vendor AdvisoryX Refsource DEBIAN
mail.python.org/pipermail/mailman-announce/2011-February/000157.htmlMailing ListX Refsource MLIST
www.ubuntu.com/usn/USN-1069-1Vendor AdvisoryX Refsource UBUNTU
www.redhat.com/support/errata/RHSA-2011-0308.htmlVendor AdvisoryX Refsource REDHAT
www.vupen.com/english/advisories/2011/0436VDB EntryX Refsource VUPENVendor Advisory
lists.apple.com/archives/Security-announce/2011//Oct/msg00003.htmlVendor AdvisoryX Refsource APPLE
www.mandriva.com/security/advisories?name=MDVSA-2011:036Vendor AdvisoryX Refsource MANDRIVA
mail.python.org/pipermail/mailman-announce/2011-February/000158.htmlMailing ListX Refsource MLISTPatch
www.securityfocus.com/bid/46464VDB EntryX Refsource BID
www.securitytracker.com/id?1025106VDB EntryX Refsource SECTRACK
secunia.com/advisories/43829Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/43425Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vupen.com/english/advisories/2011/0542VDB EntryX Refsource VUPEN
support.apple.com/kb/HT5002X Refsource CONFIRM
secunia.com/advisories/43389Third Party AdvisoryX Refsource SECUNIAVendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/65538VDB EntryX Refsource XF
lists.fedoraproject.org/pipermail/package-announce/2011-March/056363.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/43580Third Party AdvisoryX Refsource SECUNIA
lists.fedoraproject.org/pipermail/package-announce/2011-March/056399.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/43549Third Party AdvisoryX Refsource SECUNIA

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities