Medium severity · published Apr 15, 2023
CVE-2021-34337
An issue was discovered in Mailman Core before 3.3.5
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mailman · Gnu
before 3.3.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-34337
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-34337
Patch
https://gitlab.com/mailman/mailman/-/commit/e4a39488c4510fcad8851217f10e7337a196bb51
Broken Link
https://gitlab.com/mailman/mailman/-/issues/911
Release Notes
https://gitlab.com/mailman/mailman/-/tags
More from Mailman
8.8
CVE-2021-44227
In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes
8.8
CVE-2016-7123
Cross-site request forgery (CSRF) vulnerability in the admin web interface in GNU Mailman before 2.1.15 allows remote attackers to hijack the authentication of administrators
8.8
CVE-2016-6893
Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users…
8.1
CVE-2025-43920
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell…
8.0
CVE-2021-42097
GNU Mailman before 2.1.35 may allow remote Privilege Escalation