Cloudanix VulnDB

CVE-2018-5950

Medium · 6.1

CVSS

6.1

EPSS

4.6%

Published

Jan 23, 2018

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in older mailing list software lets attackers trick people into running harmful code in their web browsers when they manage email lists.

Exploit Available
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Other
Component
Application
Class
XSS
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability permits remote attackers to inject arbitrary web script or HTML via the user-options URL in the Mailman web UI, resulting in cross-site scripting that executes in the context of other users' browsers.

Why it matters to the business

Compromised user sessions in the mailing list management interface could allow unauthorized changes to email lists, subscriber data exposure, or phishing campaigns targeting organization members, increasing operational risk and potential compliance issues for systems still running unpatched versions.

How an attack unfolds

An attacker identifies a Mailman instance and crafts a malicious link embedding script payloads in the user-options URL. The link is delivered to administrators or users via email or other channels; when opened, the payload executes in the victim's browser to hijack sessions or perform actions without consent.

How to fix it

Upgrade Mailman to version 2.1.26 or later on all instances. Apply vendor-supplied patches for GNU Mailman on Debian, Ubuntu, Red Hat Enterprise Linux, and related distributions where available.

How to confirm the fix worked

Confirm Mailman version is 2.1.26 or higher via package manager or source inspection. Test user-options endpoints with known XSS payloads to verify sanitization is active.

Typical attack path

  1. Scan for exposed Mailman web UI instances on affected Linux distributions
  2. Craft and host a malicious user-options URL containing script or HTML payload
  3. Distribute the URL to targeted users through phishing or social engineering
  4. Victim interaction triggers script execution, enabling session theft or unauthorized UI actions

How to detect it

Examine web server access logs for anomalous requests to user-options URLs containing script tags, encoded payloads, or unexpected parameters. Look for browser-side indicators such as unexpected popups or session anomalies in affected environments.

What your security team should do

  • Immediately inventory all Mailman deployments and schedule upgrades to 2.1.26+
  • Restrict public access to Mailman web UI where feasible using network controls
  • Enable web application firewall rules to block common XSS patterns targeting user-options
  • Review historical access logs for suspicious user-options activity as a precaution

The record

Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL.

Affected packages

Ecosystem Package Introduced Fixed
Debian:7 mailman 0 1:2.1.15-1+deb7u3
Debian:8 mailman 0 1:2.1.18-2+deb8u2
Debian:9 mailman 0 1:2.1.23-1+deb9u2
Mageia:6 mailman 0 2.1.23-2.1.mga6
Red Hat:enterprise_linux:6::server mailman 0 3:2.1.12-26.el6_9.3
Red Hat:enterprise_linux:6::server mailman-debuginfo 0 3:2.1.12-26.el6_9.3
Red Hat:enterprise_linux:6::workstation mailman 0 3:2.1.12-26.el6_9.3
Red Hat:enterprise_linux:6::workstation mailman-debuginfo 0 3:2.1.12-26.el6_9.3
Red Hat:enterprise_linux:7::server mailman 0 3:2.1.15-26.el7_4.1
Red Hat:enterprise_linux:7::server mailman-debuginfo 0 3:2.1.15-26.el7_4.1
Red Hat:enterprise_linux:7::workstation mailman 0 3:2.1.15-26.el7_4.1
Red Hat:enterprise_linux:7::workstation mailman-debuginfo 0 3:2.1.15-26.el7_4.1
SUSE:Enterprise Storage 4 mailman 0 2.1.17-3.3.3
SUSE:Linux Enterprise Point of Sale 11 SP3 mailman 0 2.1.15-9.6.6.1
SUSE:Linux Enterprise Server 11 SP3-LTSS mailman 0 2.1.15-9.6.6.1
SUSE:Linux Enterprise Server 11 SP3-TERADATA mailman 0 2.1.15-9.6.6.1
SUSE:Linux Enterprise Server 11 SP4 mailman 0 2.1.15-9.6.6.1
SUSE:Linux Enterprise Server 12 SP1-LTSS mailman 0 2.1.17-3.3.3
SUSE:Linux Enterprise Server 12 SP2-BCL mailman 0 2.1.17-3.3.3
SUSE:Linux Enterprise Server 12 SP2-LTSS mailman 0 2.1.17-3.3.3
SUSE:Linux Enterprise Server 12 SP3 mailman 0 2.1.17-3.3.3
SUSE:Linux Enterprise Server 12 SP4 mailman 0 2.1.17-3.3.3
SUSE:Linux Enterprise Server 12-LTSS mailman 0 2.1.17-3.3.3
SUSE:Linux Enterprise Server for SAP Applications 11 SP4 mailman 0 2.1.15-9.6.6.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP1 mailman 0 2.1.17-3.3.3
SUSE:Linux Enterprise Server for SAP Applications 12 SP2 mailman 0 2.1.17-3.3.3
SUSE:Linux Enterprise Server for SAP Applications 12 SP3 mailman 0 2.1.17-3.3.3
SUSE:Linux Enterprise Server for SAP Applications 12 SP4 mailman 0 2.1.17-3.3.3
SUSE:OpenStack Cloud 7 mailman 0 2.1.17-3.3.3
Ubuntu:14.04:LTS mailman 0 1:2.1.16-2ubuntu0.5
Ubuntu:16.04:LTS mailman 0 1:2.1.20-1ubuntu0.3

Related vulnerabilities