Description
Cross-site scripting (XSS) vulnerability in the admin CGI script for Mailman before 2.1.4 allows remote attackers to steal session cookies and conduct unauthorized activities.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | mailman | 2.0.11-1woody7 | DSA-436 |
Advisories 1
- DSA-436 mailman - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2004:020 vendor-advisory
- mailman-admin-xss(14121) vdb-entry
- 10519 third-party-advisory
- MDKSA-2004:013 vendor-advisory
- 9336 vdb-entry
- oval:org.mitre.oval:def:813 vdb-entry signature
- 3305 vdb-entry
- [Mailman-Announce] 20031231 RELEASED Mailman 2.1.4 mailing-list
- CLA-2004:842 vendor-advisory
- DSA-436 vendor-advisory