CVE-2021-43331
Fixed in a distro release EPSS 1%
In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.
Products: gnu mailman, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | mailman | 3:2.1.15-30.amzn2.2.1 |
| Debian 9 | mailman | 1:2.1.23-1+deb9u8 |
| SUSE HPE Helion OpenStack 8 | mailman | 2.1.17-3.26.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | mailman | 2.1.17-3.26.1 |
| SUSE Linux Enterprise Server 12 SP3-BCL | mailman | 2.1.17-3.26.1 |
| SUSE Linux Enterprise Server 12 SP3-LTSS | mailman | 2.1.17-3.26.1 |
| SUSE Linux Enterprise Server 12 SP4-LTSS | mailman | 2.1.17-3.26.1 |
| SUSE Linux Enterprise Server 12 SP5 | mailman | 2.1.17-3.26.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | mailman | 2.1.17-3.26.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | mailman | 2.1.17-3.26.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | mailman | 2.1.17-3.26.1 |
| SUSE OpenStack Cloud 8 | mailman | 2.1.17-3.26.1 |
| SUSE OpenStack Cloud 9 | mailman | 2.1.17-3.26.1 |
| SUSE OpenStack Cloud Crowbar 8 | mailman | 2.1.17-3.26.1 |
| SUSE OpenStack Cloud Crowbar 9 | mailman | 2.1.17-3.26.1 |
| Ubuntu 18.04 LTS | mailman | 1:2.1.26-1ubuntu0.5 |
| Ubuntu Pro 16.04 LTS | mailman | 1:2.1.20-1ubuntu0.6+esm2 |
| Ubuntu Pro 20.04 LTS | mailman | 1:2.1.29-1ubuntu3.1+esm1 |