PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2021-42096

CVE-2021-42096

mailman: CSRF token derived from admin password allows offline brute-force attack

Loading…

Severity

Moderate

Red Hat Product Security

4.3

CVSS 3.1

Review impact separately from score.

Published · October 21, 2021

Updated · September 8, 2026

Description

Sensitive information is exposed to unprivileged users in mailman. The hash of the list admin password is used to derive the CSRF (Cross-site Request Forgery) token, which is exposed to unprivileged members of a list. Malicious members may use the CSRF token to perform an offline brute-force attack to retrieve the list admin password.

Statement

This issue did not affect the versions of mailman as shipped with Red Hat Enterprise Linux 6, and 7 as they did not use CSRF tokens in members pages.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor