1. CVE-Search
  2. CVE-2006-3636
ID CVE-2006-3636
Summary Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.9rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
Vulnerable Configurations
  • cpe:2.3:a:gnu:mailman:2.1:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:mailman:2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:mailman:2.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:mailman:2.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:mailman:2.1.1:beta1:*:*:*:*:*:*
    cpe:2.3:a:gnu:mailman:2.1.1:beta1:*:*:*:*:*:*
  • cpe:2.3:a:gnu:mailman:2.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:mailman:2.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:mailman:2.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:mailman:2.1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:mailman:2.1.4:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:mailman:2.1.4:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:mailman:2.1.5:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:mailman:2.1.5:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:mailman:2.1.5.8:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:mailman:2.1.5.8:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:mailman:2.1.6:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:mailman:2.1.6:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:mailman:2.1.7:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:mailman:2.1.7:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:mailman:2.1.8:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:mailman:2.1.8:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:mailman:2.1b1:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:mailman:2.1b1:*:*:*:*:*:*:*
CVSS
Base: 6.8 (as of 18-10-2018 - 16:48)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:P/A:P
oval via4
accepted 2013-04-29T04:06:39.552-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 3
    oval oval:org.mitre.oval:def:11782
  • comment CentOS Linux 3.x
    oval oval:org.mitre.oval:def:16651
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
description Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.9rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
family unix
id oval:org.mitre.oval:def:10553
status accepted
submitted 2010-07-09T03:56:16-04:00
title Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.9rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
version 29
redhat via4
advisories
bugzilla
id 1618152
title CVE-2006-3636 security flaw
oval
OR
  • comment Red Hat Enterprise Linux must be installed
    oval oval:com.redhat.rhba:tst:20070304026
  • AND
    • comment Red Hat Enterprise Linux 4 is installed
      oval oval:com.redhat.rhba:tst:20070304025
    • comment mailman is earlier than 3:2.1.5.1-34.rhel4.5
      oval oval:com.redhat.rhsa:tst:20060600001
    • comment mailman is signed with Red Hat master key
      oval oval:com.redhat.rhsa:tst:20060204002
rhsa
id RHSA-2006:0600
released 2006-09-06
severity Moderate
title RHSA-2006:0600: mailman security update (Moderate)
rpms
  • mailman-3:2.1.5.1-25.rhel3.7
  • mailman-3:2.1.5.1-34.rhel4.5
  • mailman-debuginfo-3:2.1.5.1-25.rhel3.7
  • mailman-debuginfo-3:2.1.5.1-34.rhel4.5
refmap via4
bid
  • 19831
  • 20021
bugtraq 20060913 Mailman 2.1.8 Multiple Security Issues
confirm http://sourceforge.net/project/shownotes.php?group_id=103&release_id=444295
debian DSA-1188
gentoo GLSA-200609-12
mandriva MDKSA-2006:165
misc http://moritz-naumann.com/adv/0013/mailmanmulti/0013.txt
mlist [Mailman-Announce] 20060913 RELEASED: Mailman 2.1.9
sectrack 1016808
secunia
  • 21732
  • 21792
  • 21879
  • 22011
  • 22020
  • 22227
  • 22639
suse SUSE-SR:2006:025
ubuntu USN-345-1
vupen ADV-2006-3446
xf mailman-unspecified-xss(28731)
Last major update 18-10-2018 - 16:48
Published 06-09-2006 - 00:04
Last modified 18-10-2018 - 16:48
Back to Top