GNU Mailman before 2.1.35 may allow... CVE-2021-42097

8.5 AV AC AU C I A
发布: 2021-10-21
修订: 2021-11-05

GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).