CVE-2006-4624

mailman logfile CRLF injection

Severity Score

2.6

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

CRLF injection vulnerability in Utils.py in Mailman before 2.1.9rc1 allows remote attackers to spoof messages in the error log and possibly trick the administrator into visiting malicious URLs via CRLF sequences in the URI.

Vulnerabilidad de inyección CRLF en Utils.py de Mailman anterior a 2.1.9rc1 permite a atacantes remotos suplantar mensajes en el log de errores y posiblemente engañar al administrador para que visite URLs maliciosas mediante secuencias CLRF en la URI.

*Credits: N/A

CVSS Scores

NISTv2 2.6

Attack Vector

Network

Attack Complexity

High

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2006-09-07 CVE Reserved
2006-09-07 CVE Published
2024-05-13 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-94: Improper Control of Generation of Code ('Code Injection')

CAPEC

References (23)

URL	Tag	Source
http://mail.python.org/pipermail/mailman-announce/2006-September/000087.html	Mailing List
http://moritz-naumann.com/adv/0013/mailmanmulti/0013.txt	X_refsource_misc
http://svn.sourceforge.net/viewvc/mailman/trunk/mailman/Mailman/Utils.py?r1=7859&r2=7923	X_refsource_misc
http://www.securityfocus.com/archive/1/445992/100/0/threaded	Mailing List
http://www.securityfocus.com/bid/19831	Vdb Entry
http://www.securityfocus.com/bid/20021	Vdb Entry
http://www.vupen.com/english/advisories/2006/3446	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/28734	Vdb Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9756	Signature

URL	Date	SRC

URL	Date	SRC
http://secunia.com/advisories/21732	2018-10-17
http://sourceforge.net/project/shownotes.php?group_id=103&release_id=444295	2018-10-17

URL	Date	SRC
http://secunia.com/advisories/22011	2018-10-17
http://secunia.com/advisories/22020	2018-10-17
http://secunia.com/advisories/22227	2018-10-17
http://secunia.com/advisories/22639	2018-10-17
http://secunia.com/advisories/27669	2018-10-17
http://security.gentoo.org/glsa/glsa-200609-12.xml	2018-10-17
http://www.debian.org/security/2006/dsa-1188	2018-10-17
http://www.mandriva.com/security/advisories?name=MDKSA-2006:165	2018-10-17
http://www.novell.com/linux/security/advisories/2006_25_sr.html	2018-10-17
http://www.redhat.com/support/errata/RHSA-2007-0779.html	2018-10-17
https://access.redhat.com/security/cve/CVE-2006-4624	2007-11-15
https://bugzilla.redhat.com/show_bug.cgi?id=205651	2007-11-15

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Gnu Search vendor "Gnu"		Mailman Search vendor "Gnu" for product "Mailman"				<= 2.1.8 Search vendor "Gnu" for product "Mailman" and version " <= 2.1.8"		-		Affected