Cross-site Request Forgery (CSRF) Affecting mailman-debuginfo package, versions <3:2.1.15-30.amzn2.2


Severity

Recommended
0.0
high
0
10

Based on Amazon Linux security rating.

Threat Intelligence

EPSS
0.11% (45th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Cross-site Request Forgery (CSRF) vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-AMZN2-MAILMANDEBUGINFO-2349178
  • published21 Jan 2022
  • disclosed2 Dec 2021

Introduced: 2 Dec 2021

CVE-2021-44227  (opens in a new tab)
CWE-352  (opens in a new tab)

How to fix?

Upgrade Amazon-Linux:2 mailman-debuginfo to version 3:2.1.15-30.amzn2.2 or higher.
This issue was patched in ALAS2-2022-1740.

NVD Description

Note: Versions mentioned in the description apply only to the upstream mailman-debuginfo package and not the mailman-debuginfo package as distributed by Amazon-Linux. See How to fix? for Amazon-Linux:2 relevant fixed versions and status.

In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.

CVSS Scores

version 3.1