CVE-2021-43332

mailman: a list moderator can crack the list admin password encrypted in a CSRF token

Loading…

Severity

Moderate

Red Hat Product Security

6.5

CVSS 3.1

Review impact separately from score.

Published · November 13, 2021

Updated · November 22, 2025

Description

A flaw was found in mailman, where the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This flaw could potentially allow cracking of the password by a moderator utilizing an offline brute-force attack

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-307 · Improper Restriction of Excessive Authentication Attempts