HTTP: Mailman "options.py" Cross-Site Scripting
This signature detects attempts to exploit a cross-site scripting vulnerability in Mailman 2.1, a discussion list management application that uses Web pages. Attackers can include options.py in a maliciously crafted URI sent to Mailman scripts, enabling attackers to place scripts or HTML into discussion list Web pages.
Extended Description
A vulnerability has been discovered in GNU Mailman. The issue occurs to insufficient sanitization of user-supplied data which is output when generating error pages. As a result, attackers may embed malicious script code or HTML into a link to a site running the vulnerable software. If such a link is followed, the attacker-supplied code will be interpreted in the web browser of the victim of the attack. It may be possible to steal the unsuspecting user's cookie-based authentication credentials, as well as other sensitive information. Other attacks are also possible. It has been reported that GNU Mailman 2.0.11 is not affected by this issue.
Affected Products
Gnu mailman
Short Name
HTTP:XSS:MAILMAN-OPTIONS
Severity
Warning
Recommended
False
Recommended Action
None
Category
HTTP
Keywords
"options.py" CVE-2003-0038 Cross-Site Mailman Scripting bid:6678
Release Date
01/19/2005
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3336
False Positive
Unknown
Vendors
Gnu
CVSS Score
4.3