CVE-2021-46900 Weak cryptography in n/a

High 7.5 Published 31 Dec 2023 Updated 17 Apr 2025

Sympa uses a predictable cookie as a password salt and XSS protection, allowing attackers to bypass security mechanisms and potentially access sensitive data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-46900?

CVE-2021-46900 is a high-severity vulnerability in n/a, published on 31 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Sympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an unpredictable value. Specifically, the cookie parameter is both a salt for stored passwords and an XSS protection mechanism.

Weakness: CWE-327

Which versions are affected by CVE-2021-46900?

It affects 1 product.

Products include Sympa Sympa.

How do I fix CVE-2021-46900?

Upgrade to a fixed version.

Is CVE-2021-46900 being exploited?

There is no known exploitation of CVE-2021-46900 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2021-46900, GHSA-qvwx-3j2c-25v2, UBUNTU-CVE-2021-46900.