CVE-2016-6893

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-09-02 · updated 2026-06-17
Weakness: CWE-352

Description

Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account.

Affected products

GNU Mailman: 2.1, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5 (+40)

References

http://www.debian.org/security/2016/dsa-3668
http://www.securityfocus.com/bid/92731
http://www.securitytracker.com/id/1036728
https://bugs.launchpad.net/bugs/1614841
http://www.debian.org/security/2016/dsa-3668
http://www.securityfocus.com/bid/92731
http://www.securitytracker.com/id/1036728
https://bugs.launchpad.net/bugs/1614841

Get alerted when CVE-2016-6893 or the next vulnerability affects your stack