10 lines
No EOL
832 B
Text
10 lines
No EOL
832 B
Text
source: http://www.securityfocus.com/bid/6678/info
|
|
|
|
A vulnerability has been discovered in GNU Mailman. The issue occurs to insufficient sanitization of user-supplied data which is output when generating error pages.
|
|
|
|
As a result, attackers may embed malicious script code or HTML into a link to a site running the vulnerable software. If such a link is followed, the attacker-supplied code will be interpreted in the web browser of the victim of the attack. It may be possible to steal the unsuspecting user's cookie-based authentication credentials, as well as other sensitive information. Other attacks are also possible.
|
|
|
|
It has been reported that GNU Mailman 2.0.11 is not affected by this issue.
|
|
|
|
https://www.yourserver.com:443//mailman/options/yourlist?
|
|
language=<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> |