In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Link | Tags |
---|---|
https://bugs.launchpad.net/mailman/+bug/1952384 | issue tracking mailing list patch third party advisory |
https://lists.debian.org/debian-lts-announce/2022/06/msg00011.html | third party advisory mailing list |