Login Request a demo
Unscored severity · published Sep 15, 2010
CVE-2010-3089
Multiple cross-site scripting (XSS) vulnerabilities in GNU Mailman before 2.1.14rc1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving…
–
CVSS
2%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in GNU Mailman before 2.1.14rc1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving (1) the list information field or (2) the list description field.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mailman · Gnu
through 2.1.13; 2.1; 2.1; 2.1; 2.1; 2.1.1; +14 more · source: NVD
Affected product
MA
Mailman
Gnu
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-3089
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-3089
lists.apple.com
http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052297.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052312.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2011-05/msg00000.html
mail.python.org
http://mail.python.org/pipermail/mailman-announce/2010-September/000150.html
More from Mailman
8.8
CVE-2021-44227
In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes
8.8
CVE-2016-7123
Cross-site request forgery (CSRF) vulnerability in the admin web interface in GNU Mailman before 2.1.15 allows remote attackers to hijack the authentication of administrators
8.8
CVE-2016-6893
Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users…
8.1
CVE-2025-43920
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell…
8.0
CVE-2021-42097
GNU Mailman before 2.1.35 may allow remote Privilege Escalation