CVE-2016-6893
Last modified
CVE-2016-6893 is a vulnerability of currently unknown severity. Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account.. EPSS estimates a 1.61% chance of exploitation in the next 30 days.
Description
Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gnu | Mailman | 2.1 |
| Gnu | Mailman | 2.1.1 |
| Gnu | Mailman | 2.1.2 |
| Gnu | Mailman | 2.1.3 |
| Gnu | Mailman | 2.1.4 |
| Gnu | Mailman | 2.1.5 |
| Gnu | Mailman | 2.1.6 |
| Gnu | Mailman | 2.1.8 |
| Gnu | Mailman | 2.1.9 |
| Gnu | Mailman | 2.1.10 |
| Gnu | Mailman | 2.1.10b1 |
| Gnu | Mailman | 2.1.10b3 |
| Gnu | Mailman | 2.1.10b4 |
| Gnu | Mailman | 2.1.11 |
| Gnu | Mailman | 2.1.12 |
| Gnu | Mailman | 2.1.13 |
| Gnu | Mailman | 2.1.14 |
| Gnu | Mailman | 2.1.14-1 |
| Gnu | Mailman | 2.1.15 |
| Gnu | Mailman | 2.1.16 |
| Gnu | Mailman | 2.1.17 |
| Gnu | Mailman | 2.1.18 |
| Gnu | Mailman | 2.1.18-1 |
| Gnu | Mailman | 2.1.19 |
| Gnu | Mailman | 2.1.20 |
| Gnu | Mailman | 2.1.21 |
| Gnu | Mailman | 2.1.22 |
| Gnu | Mailman | 2.1.23 |
References
- https://bugs.launchpad.net/bugs/1614841Issue Tracking
- https://bugs.launchpad.net/bugs/1614841Issue Tracking
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2016-6893?
How severe is CVE-2016-6893?
How do I fix CVE-2016-6893?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2016
- CVE-2016-6886The pstm_reverse function in MatrixSSL before 3.8.4 allows r…
- CVE-2016-6887The pstm_exptmod function in MatrixSSL 3.8.6 and earlier doe…
- CVE-2016-6888Integer overflow in the net_tx_pkt_init function in hw/net/n…4.4
- CVE-2016-6890Heap-based buffer overflow in MatrixSSL before 3.8.6 allows …
- CVE-2016-6891MatrixSSL before 3.8.6 allows remote attackers to cause a de…
- CVE-2016-6892The x509FreeExtensions function in MatrixSSL before 3.8.6 al…
- CVE-2016-6894Arista EOS 4.15 before 4.15.8M, 4.16 before 4.16.7M, and 4.1…
- CVE-2016-6895Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2016-6896Directory traversal vulnerability in the wp_ajax_update_plug…
- CVE-2016-6897Cross-site request forgery (CSRF) vulnerability in the wp_aj…
- CVE-2016-6898XML external entity (XXE) vulnerability in the Hyper Managem…
- CVE-2016-6899The Intelligent Baseboard Management Controller (iBMC) in Hu…
Are you affected by CVE-2016-6893?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST