| Severity |
|
| Remote |
|
| Type |
| - |
Unknown |
| + |
Private key recovery |
|
| Description |
| + |
GNU Mailman before 2.1.35 may allow remote privilege escalation. A certain csrf_token value is derived from the admin password, and may be useful in conducting a brute-force attack against that password. |
|
| References |
| + |
https://mail.python.org/archives/list/mailman-announce@python.org/thread/IKCO6JU755AP5G5TKMBJL6IEZQTTNPDQ/ |
| + |
https://bugs.launchpad.net/mailman/+bug/1947639 |
| + |
https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1873 |
|
| Notes |
|