CVE-2020-12137 Cross-site scripting in n/a
An attacker can execute arbitrary JavaScript in the context of list-archive visitors by exploiting MIME sniffing issues in GNU Mailman.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-12137?
CVE-2020-12137 is a medium-severity cross-site scripting vulnerability in Canonical Ubuntu Linux, published on 24 Apr 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code.
Weakness: CWE-79
Which versions are affected by CVE-2020-12137?
It affects 6 products.
Linux distribution packages (5)
mailman Red Hat:enterprise_linux:8::appstream | All versions | 3:2.1.29-10.module+el8.3.0+6860+8e47d84b |
mailman-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 3:2.1.29-10.module+el8.3.0+6860+8e47d84b |
mailman-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 3:2.1.29-10.module+el8.3.0+6860+8e47d84b |
mailman SUSE:Linux Enterprise Point of Sale 11 SP3 | All versions | 2.1.15-9.6.20.1 |
mailman SUSE:Linux Enterprise Server 11 SP4-LTSS | All versions | 2.1.15-9.6.20.1 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Gnu Mailman, Opensuse Backports Sle, Opensuse Leap.
How do I fix CVE-2020-12137?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-12137 being exploited?
There is no known exploitation of CVE-2020-12137 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DLA-2200-1, DSA-4664-1, GHSA-7mvx-jp9h-p8gh, RHSA-2020:4667, SUSE-SU-2020:14356-1, UBUNTU-CVE-2020-12137.