VulnerabilityModified
CVE-2021-34337
An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls.
MEDIUM 6.3EPSS 0.30%
Does this matter?
Lower severity and a low EPSS score (0.30%). Track it; it rarely justifies an emergency change on its own.
Description
An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.
- CVSS 3.1
- 6.3 MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- EPSS
- 0.30% probability · 23th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-208
- Affected
- gnu/mailman
- Source
- cve@mitre.org
References
- https://gitlab.com/mailman/mailman/-/commit/e4a39488c4510fcad8851217f10e7337a196bb51Patch, Vendor Advisory
- https://gitlab.com/mailman/mailman/-/issues/911Broken Link
- https://gitlab.com/mailman/mailman/-/tagsRelease Notes
- https://gitlab.com/mailman/mailman/-/commit/e4a39488c4510fcad8851217f10e7337a196bb51Patch, Vendor Advisory
- https://gitlab.com/mailman/mailman/-/issues/911Broken Link
- https://gitlab.com/mailman/mailman/-/tagsRelease Notes
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.