Vulnerability Name:

CVE-2010-3089 (CCN-61787)

Assigned:2010-09-09
Published:2010-09-09
Updated:2023-02-13
Summary:Multiple cross-site scripting (XSS) vulnerabilities in GNU Mailman before 2.1.14rc1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving (1) the list information field or (2) the list description field.
CVSS v3 Severity:2.6 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:3.5 Low (CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
3.0 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
3.5 Low (CCN CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
3.0 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.0 Medium (REDHAT CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
3.5 Low (REDHAT Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2010-3089

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: RHSA-2011-0307
Moderate: mailman security update

Source: CCN
Type: RHSA-2011-0308
Moderate: mailman security update

Source: CCN
Type: SA41265
Mailman List Description Two Script Insertion Vulnerabilities

Source: CCN
Type: Apple Web site
About the security content of Mac OS X v10.6.7 and Security Update 2011-001

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: DEBIAN
Type: DSA-2170
mailman -- several vulnerabilities

Source: CCN
Type: Mailman Web site
Mailman, the GNU Mailing List Manager

Source: CCN
Type: OSVDB ID: 68032
Mailman HTMLFormatter.py List Description Field XSS

Source: CCN
Type: OSVDB ID: 68035
Mailman listinfo.py List Description Field XSS

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: BID-43187
GNU Mailman Multiple Cross Site Scripting Vulnerabilities

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: Red Hat Bugzilla Bug 631881
CVE-2010-3089 Mailman: Cross-site scripting (XSS) via list information HTML template

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: XF
Type: UNKNOWN
mailman-list-xss(61787)

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: SUSE
Type: SUSE-SR:2011:007
SUSE Security Summary Report

Source: SUSE
Type: SUSE-SR:2011:009
SUSE Security Summary Report

Vulnerable Configuration:Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:4:*:*:*:*:*:*:*
  • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*
  • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*
  • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*
  • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*
  • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
  • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*
  • Configuration RedHat 8:
  • cpe:/o:redhat:enterprise_linux:6:*:*:*:*:*:*:*
  • Configuration RedHat 9:
  • cpe:/o:redhat:enterprise_linux:6::server:*:*:*:*:*
  • Configuration RedHat 10:
  • cpe:/o:redhat:enterprise_linux:6::workstation:*:*:*:*:*

  • Configuration CCN 1:
  • cpe:/o:apple:mac_os_x_server:10.6:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.6:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.6.1:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.6.1:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.6.2:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.6.2:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.6.3:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.6.3:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.6.4:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.6.4:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:mailman:2.1.13:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.6.5:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.6.5:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.6.6:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.6.6:*:*:*:*:*:*:*
  • AND
  • cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0::x86_64:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client_workstation:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0::x86-64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandriva:linux:2009.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandriva:linux:2009.0:-:x86_64:*:*:*:*:*
  • OR cpe:/o:mandriva:linux:2009.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandriva:linux:2009.1:*:*:*:x86_64:*:*:*
  • OR cpe:/o:mandriva:enterprise_server:5:*:*:*:*:*:*:*
  • OR cpe:/o:mandriva:enterprise_server:5:*:*:*:x86_64:*:*:*
  • OR cpe:/o:mandriva:linux:2010:*:*:*:x86_64:*:*:*
  • OR cpe:/o:mandriva:linux:2010:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:6:*:server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:6:*:workstation:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_eus:5.6.z::server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_long_life:5.6:*:*:*:*:*:*:*

  • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:42396
    P
    Security update for xen (Important)
    2022-06-13
    oval:org.opensuse.security:def:20103089
    V
    CVE-2010-3089
    2022-05-20
    oval:org.opensuse.security:def:42189
    P
    Security update for the Linux Kernel (Important)
    2022-01-26
    oval:org.opensuse.security:def:26218
    P
    Security update for java-1_8_0-ibm (Important) (in QA)
    2022-01-04
    oval:org.opensuse.security:def:31335
    P
    Security update for xorg-x11-server (Important)
    2021-12-20
    oval:org.opensuse.security:def:31717
    P
    Security update for openssh (Important)
    2021-12-06
    oval:org.opensuse.security:def:32232
    P
    Security update for webkit2gtk3 (Important)
    2021-12-01
    oval:org.opensuse.security:def:31706
    P
    Security update for postgresql96 (Important)
    2021-11-22
    oval:org.opensuse.security:def:31705
    P
    Security update for postgresql, postgresql13, postgresql14 (Important)
    2021-11-20
    oval:org.opensuse.security:def:26169
    P
    Security update for postgresql, postgresql13, postgresql14 (Important)
    2021-11-20
    oval:org.opensuse.security:def:31703
    P
    Security update for MozillaFirefox (Important)
    2021-11-17
    oval:org.opensuse.security:def:32210
    P
    Security update for opensc (Important)
    2021-10-29
    oval:org.opensuse.security:def:26130
    P
    Security update for ghostscript (Critical)
    2021-09-21
    oval:org.opensuse.security:def:26116
    P
    Security update for apache2 (Important)
    2021-09-02
    oval:org.opensuse.security:def:31261
    P
    Security update for bind (Moderate)
    2021-08-30
    oval:org.opensuse.security:def:31674
    P
    Security update for aspell (Important)
    2021-08-25
    oval:org.opensuse.security:def:32171
    P
    Security update for the Linux Kernel (Live Patch 36 for SLE 12 SP3) (Important)
    2021-08-25
    oval:org.opensuse.security:def:31250
    P
    Security update for openssl (Important)
    2021-08-24
    oval:org.opensuse.security:def:31249
    P
    Security update for python-PyYAML (Important)
    2021-08-24
    oval:org.opensuse.security:def:26108
    P
    Security update for openssl-1_1 (Important)
    2021-08-24
    oval:org.opensuse.security:def:32159
    P
    Security update for webkit2gtk3 (Important)
    2021-08-03
    oval:org.opensuse.security:def:32953
    P
    Security update for ovmf (Important)
    2021-06-22
    oval:org.opensuse.security:def:32122
    P
    Security update for apache2 (Important)
    2021-06-17
    oval:org.opensuse.security:def:26073
    P
    Security update for libjpeg-turbo (Moderate)
    2021-06-11
    oval:org.opensuse.security:def:42646
    P
    mailman-2.1.14-9.6.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:36239
    P
    mailman-2.1.14-9.6.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:32914
    P
    Security update for avahi (Important)
    2021-06-03
    oval:org.opensuse.security:def:26064
    P
    Security update for libwebp (Critical)
    2021-06-02
    oval:org.opensuse.security:def:26050
    P
    Security update for python3 (Important)
    2021-05-17
    oval:org.opensuse.security:def:31616
    P
    Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:32072
    P
    Security update for xen (Important)
    2021-04-19
    oval:org.opensuse.security:def:32069
    P
    Security update for xorg-x11-server (Important)
    2021-04-14
    oval:org.opensuse.security:def:32066
    P
    Security update for the Linux Kernel (Live Patch 38 for SLE 12 SP3) (Important)
    2021-04-07
    oval:org.opensuse.security:def:26214
    P
    Security update for wavpack (Important)
    2021-03-24
    oval:org.opensuse.security:def:32276
    P
    Security update for the Linux Kernel (Live Patch 36 for SLE 12 SP3) (Important)
    2021-03-17
    oval:org.opensuse.security:def:32015
    P
    Security update for openssl (Important)
    2020-12-11
    oval:org.opensuse.security:def:32003
    P
    Security update for python-cryptography (Moderate)
    2020-12-04
    oval:org.opensuse.security:def:35782
    P
    mailman-2.1.14-9.2.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:31559
    P
    Security update for gdm (Important)
    2020-12-03
    oval:org.opensuse.security:def:35989
    P
    mailman-2.1.14-9.6.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:25344
    P
    Security update for krb5 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25881
    P
    Security update for flash-player (Important)
    2020-12-01
    oval:org.opensuse.security:def:25617
    P
    Security update for jasper (Low)
    2020-12-01
    oval:org.opensuse.security:def:26467
    P
    Security update for redis (Important)
    2020-12-01
    oval:org.opensuse.security:def:31791
    P
    Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:32707
    P
    libcgroup1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31468
    P
    Security update for powerpc-utils
    2020-12-01
    oval:org.opensuse.security:def:25909
    P
    Security update for flash-player (Important)
    2020-12-01
    oval:org.opensuse.security:def:26564
    P
    gzip on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26271
    P
    Security update for openconnect (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25788
    P
    Security update for zeromq (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31766
    P
    Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:31467
    P
    Security update for postgresql94 (Important)
    2020-12-01
    oval:org.opensuse.security:def:32371
    P
    Security update for tcpdump (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26988
    P
    mailman on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25864
    P
    Security update for php5 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26746
    P
    libfreebl3 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25551
    P
    Security update for tomcat (Important)
    2020-12-01
    oval:org.opensuse.security:def:32481
    P
    NetworkManager on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25333
    P
    Security update for apache-commons-httpclient (Important)
    2020-12-01
    oval:org.opensuse.security:def:25824
    P
    Security update for mariadb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31964
    P
    Security update for icu (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33202
    P
    mailman on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25536
    P
    Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:26418
    P
    Security update for pdns-recursor (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31457
    P
    Security update for postgresql91
    2020-12-01
    oval:org.opensuse.security:def:25758
    P
    Security update for flash-player (Important)
    2020-12-01
    oval:org.opensuse.security:def:26520
    P
    PolicyKit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26257
    P
    Security update for icu (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26011
    P
    Security update for gwenhywfar (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27237
    P
    mailman on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32315
    P
    Security update for rsync (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26953
    P
    libicu-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25800
    P
    Security update for polkit (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31910
    P
    Security update for fuse (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25540
    P
    Security update for java-1_7_1-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:32459
    P
    Security update for xorg-x11-libX11 (Important)
    2020-12-01
    oval:org.opensuse.security:def:25332
    P
    Security update for sane-backends (Important)
    2020-12-01
    oval:org.opensuse.security:def:25743
    P
    Security update for libssh (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31915
    P
    Security update for gd (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33163
    P
    libmysql55client18-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25408
    P
    Security update for sane-backends (Important)
    2020-12-01
    oval:org.opensuse.security:def:26365
    P
    Security update of chromium (Important)
    2020-12-01
    oval:org.opensuse.security:def:25965
    P
    Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:32025
    P
    Security update for kernel-source (Important)
    2020-12-01
    oval:org.opensuse.security:def:31456
    P
    Security update for postgresql91
    2020-12-01
    oval:org.opensuse.security:def:25674
    P
    Security update for the Linux Kernel (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26506
    P
    Security update for chromium (Important)
    2020-12-01
    oval:org.opensuse.security:def:31923
    P
    Security update for ghostscript-library (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32746
    P
    mailman on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31542
    P
    Security update for samba (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25962
    P
    Security update for mariadb (Important)
    2020-12-01
    oval:org.opensuse.security:def:27202
    P
    libnewt0_52 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26315
    P
    Security update for MozillaThunderbird (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25789
    P
    Security update for flash-player (Critical)
    2020-12-01
    oval:org.opensuse.security:def:31823
    P
    Security update for bash (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25539
    P
    Security update for dbus-1 (Important)
    2020-12-01
    oval:org.opensuse.security:def:32420
    P
    Security update for wireshark (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25992
    P
    Security update for webkit2gtk3 (Important)
    2020-12-01
    oval:org.opensuse.security:def:26781
    P
    mailman on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25615
    P
    Security update for samba (Important)
    2020-12-01
    oval:org.opensuse.security:def:31859
    P
    Security update for curl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32525
    P
    gstreamer-0_10-plugins-base on GA media (Moderate)
    2020-12-01
    oval:org.mitre.oval:def:12397
    P
    DSA-2170-1 mailman -- several
    2014-07-21
    oval:org.mitre.oval:def:13726
    P
    USN-1069-1 -- mailman vulnerabilities
    2014-06-30
    oval:org.mitre.oval:def:23255
    P
    ELSA-2011:0307: mailman security update (Moderate)
    2014-05-26
    oval:org.mitre.oval:def:23190
    P
    ELSA-2011:0308: mailman security update (Moderate)
    2014-05-26
    oval:org.mitre.oval:def:21661
    P
    RHSA-2011:0307: mailman security update (Moderate)
    2014-02-24
    oval:org.mitre.oval:def:21908
    P
    RHSA-2011:0308: mailman security update (Moderate)
    2014-02-24
    oval:com.redhat.rhsa:def:20110307
    P
    RHSA-2011:0307: mailman security update (Moderate)
    2011-03-01
    oval:com.redhat.rhsa:def:20110308
    P
    RHSA-2011:0308: mailman security update (Moderate)
    2011-03-01
    BACK
    apple mac os x server 10.6
    apple mac os x 10.6
    apple mac os x server 10.6.1
    apple mac os x 10.6.1
    apple mac os x server 10.6.2
    apple mac os x 10.6.2
    apple mac os x 10.6.3
    apple mac os x server 10.6.3
    apple mac os x server 10.6.4
    apple mac os x 10.6.4
    gnu mailman 2.1.13
    apple mac os x server 10.6.5
    apple mac os x 10.6.5
    apple mac os x server 10.6.6
    apple mac os x 10.6.6
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    mandrakesoft mandrake linux corporate server 4.0
    mandrakesoft mandrake linux corporate server 4.0
    redhat enterprise linux 5
    redhat enterprise linux 5
    mandrakesoft mandrake linux 2008.0
    mandrakesoft mandrake linux 2008.0
    mandriva linux 2009.0
    mandriva linux 2009.0 -
    mandriva linux 2009.1
    mandriva linux 2009.1
    mandriva enterprise server 5
    mandriva enterprise server 5
    mandriva linux 2010
    mandriva linux 2010
    redhat enterprise linux 6
    redhat enterprise linux 6
    redhat enterprise linux eus 5.6.z
    redhat enterprise linux long life 5.6