CVE-2021-43331

Vulnerability

An XSS vulnerability exists in GNU Mailman versions prior to 2.1.36. The bug resides in the Cgi/options.py user options page, where a crafted URL can inject arbitrary JavaScript that executes in the context of a user's browser. This occurs because input is not properly sanitized before being reflected in the page response [1][2].

Exploitation

An attacker needs to craft a malicious URL pointing to the user options page and entice a victim (typically a mailing list user or administrator) to click it. No authentication is required for the crafted URL to exploit the flaw; the victim's session will process the injected script when the page loads [1][2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser. This can lead to session hijacking, defacement, or theft of sensitive information displayed on the page (e.g., private account settings or CSRF tokens). The attacker gains no direct access to the server but can impersonate the victim within the Mailman application [1][2].

Mitigation

The vulnerability is fixed in GNU Mailman 2.1.36, released on 2021-11-12. For versions prior, users should upgrade immediately, as no other workaround is provided by the vendor. Mailman 2.1.36 is available from Launchpad, GNU FTP, and SourceForge [2].