Base Score

MEDIUM6.1

CVE-2018-5950

Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL.

VectorNETWORK

Published Bycve@mitre.org

Published DateJan 23, 2018, 16:29

Weakness Type (CWE):CWE-79

CVSS Metrics

Base Score

6.1

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Base Severity

MEDIUM

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

NONE

User Interaction (UI)

REQUIRED

Scope (S)

CHANGED

Confidentiality (C)

LOW

Integrity (I)

LOW

Availability (A)

NONE

References

http://packetstormsecurity.com/files/159761/Mailman-2.1.23-Cross-Site-Scripting.html
http://www.securityfocus.com/bid/104594
https://access.redhat.com/errata/RHSA-2018:0504
https://access.redhat.com/errata/RHSA-2018:0505
https://bugs.launchpad.net/mailman/+bug/1747209
https://lists.debian.org/debian-lts-announce/2018/02/msg00007.html
https://usn.ubuntu.com/3563-1/
https://www.debian.org/security/2018/dsa-4108
https://www.mail-archive.com/mailman-users%40python.org/msg70375.html

Base Score

MEDIUM6.1

Weakness Type (CWE):CWE-79

CVSS Metrics

Base Score

6.1

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Base Severity

MEDIUM

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

NONE

User Interaction (UI)

REQUIRED

Scope (S)

CHANGED

Confidentiality (C)

LOW

Integrity (I)

LOW

Availability (A)

NONE