CVE-2016-6893 Cross-site request forgery in n/a
Remote attackers can hijack user authentication via CSRF to modify options and potentially access victim credentials in GNU Mailman.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2016-6893?
CVE-2016-6893 is a high-severity vulnerability in n/a, published on 2 Sep 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account.
Weakness: CWE-352
Which versions are affected by CVE-2016-6893?
It affects 1 product.
Linux distribution packages (4)
mailman SUSE:Linux Enterprise Point of Sale 11 SP3 | All versions | 2.1.15-9.6.12.1 |
mailman SUSE:Linux Enterprise Server 11 SP4 | All versions | 2.1.15-9.6.3.1 |
mailman SUSE:Linux Enterprise Server 11 SP4-LTSS | All versions | 2.1.15-9.6.12.1 |
mailman SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 2.1.15-9.6.3.1 |
Products include Gnu Mailman.
How do I fix CVE-2016-6893?
Upgrade to a fixed version.
Is CVE-2016-6893 being exploited?
There is no known exploitation of CVE-2016-6893 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DLA-608-1, DSA-3668-1, GHSA-46p3-9vjv-gq2w, MGASA-2016-0343, SUSE-SU-2018:1638-1, SUSE-SU-2019:14068-1 and 1 more.