CVE-2018-1000671
sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open...
sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The "referer" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's browser must follow a URL supplied by the attacker. This vulnerability appears to have been fixed in none available.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The "referer" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's browser must follow a URL supplied by the attacker. This vulnerability appears to have been fixed in none available.
- Record
CVE-2018-1000671- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
CVE List No score
sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The "referer" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's browser must follow a URL supplied by the attacker. This vulnerability appears to have been fixed in none available.
- Record
CVE-2018-1000671- Updated
- 2026-11-02
EUVDEUVD-2018-2000 No score
sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The "referer" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's browser must follow a URL supplied by the attacker. This vulnerability appears to have been fixed in none available.
- Record
EUVD-2018-2000- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rxx7-mqqx-phw8
sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open...
sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The "referer" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's browser must follow a URL supplied by the attacker. This vulnerability appears to have been fixed in none available.
- Record
GHSA-rxx7-mqqx-phw8- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The "referer" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's browser must follow a URL supplied by the attacker. This vulnerability appears to have been fixed in none available.
- Record
CVE-2018-1000671- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-1000671
sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The "referer" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's browser must follow a URL supplied by the attacker. This vulnerability appears to have been fixed in none available.
- Record
DEBIAN-CVE-2018-1000671- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-1000671
sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The "referer" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's browser must follow a URL supplied by the attacker. This vulnerability appears to have been fixed in none available.
- Record
UBUNTU-CVE-2018-1000671- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUSN-4442-1 No score
sympa vulnerabilities
Michael Kaczmarczik discovered that Sympa incorrectly handled HTTP GET/POST requests. An attacker could possibly use this issue to insert, edit or obtain sensitive information. (CVE-2018-1000550)
It was discovered that Sympa incorrectly handled URL parameters. An attacker could possibly use this issue to perform XSS attacks. (CVE-2018-1000671)
Nicolas Chatelain discovered that Sympa incorrectly handled environment variables. An attacker could possibly use this issue with a setuid binary and gain root privileges. (CVE-2020-10936)
- Record
USN-4442-1- Updated
- 2026-11-02
OSVUSN-4442-2 No score
sympa vulnerabilities
USN-4442-1 fixed vulnerabilities in Sympa. This update provides the corresponding updates for Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. Original advisory details:
Nicolas Chatelain discovered that Sympa incorrectly handled environment variables. An attacker could possibly use this issue with a setuid binary and gain root privileges. (CVE-2020-10936)
Michael Kaczmarczik discovered that Sympa incorrectly handled HTTP GET/POST requests. An attacker could possibly use this issue to insert, edit or obtain sensitive information. This issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2018-1000550)
It was discovered that Sympa incorrectly handled URL parameters. An attacker could possibly use this issue to perform XSS attacks. This issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2018-1000671)
- Record
USN-4442-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sympaDebian:12 |
before 6.2.36~dfsg-1 | 6.2.36~dfsg-1 |
sympaDebian:13 |
before 6.2.36~dfsg-1 | 6.2.36~dfsg-1 |
sympaDebian:14 |
before 6.2.36~dfsg-1 | 6.2.36~dfsg-1 |
sympaDebian:8 |
before 6.1.23~dfsg-2+deb8u3, plus listed versions 6.1.23~dfsg-26.1.23~dfsg-2+deb8u16.1.23~dfsg-2+deb8u2 |
6.1.23~dfsg-2+deb8u3 |
sympaDebian:9 |
before 6.2.16~dfsg-3+deb9u4, plus listed versions 6.2.16~dfsg-36.2.16~dfsg-3+deb9u16.2.16~dfsg-3+deb9u26.2.16~dfsg-3+deb9u3 |
6.2.16~dfsg-3+deb9u4 |
sympaUbuntu:Pro:14.04:LTS |
before 6.1.17~dfsg-1ubuntu0.1~esm1, plus listed versions 6.1.11~dfsg-56.1.17~dfsg-1 |
6.1.17~dfsg-1ubuntu0.1~esm1 |
sympaUbuntu:Pro:16.04:LTS |
before 6.1.24~dfsg-1ubuntu0.1~esm1, plus listed versions 6.1.24~dfsg-1 |
6.1.24~dfsg-1ubuntu0.1~esm1 |
sympaUbuntu:Pro:18.04:LTS |
before 6.2.24~dfsg-1ubuntu0.1~esm1, plus listed versions 6.2.18~dfsg-16.2.22~dfsg-16.2.24~dfsg-1 |
6.2.24~dfsg-1ubuntu0.1~esm1 |
sympaUbuntu:Pro:14.04:LTS From an advisory covering 3 CVEs |
before 6.1.17~dfsg-1ubuntu0.1~esm1, plus listed versions 6.1.11~dfsg-56.1.17~dfsg-1 |
6.1.17~dfsg-1ubuntu0.1~esm1 |
sympaUbuntu:Pro:16.04:LTS From an advisory covering 3 CVEs |
before 6.1.24~dfsg-1ubuntu0.1~esm1, plus listed versions 6.1.24~dfsg-1 |
6.1.24~dfsg-1ubuntu0.1~esm1 |
sympaUbuntu:Pro:18.04:LTS From an advisory covering 3 CVEs |
before 6.2.24~dfsg-1ubuntu0.1~esm1, plus listed versions 6.2.18~dfsg-16.2.22~dfsg-16.2.24~dfsg-1 |
6.2.24~dfsg-1ubuntu0.1~esm1 |
sympaUbuntu:Pro:20.04:LTS From an advisory covering 3 CVEs |
before 6.2.40~dfsg-4ubuntu0.20.04.1~esm1, plus listed versions 6.2.40~dfsg-16.2.40~dfsg-36.2.40~dfsg-4 |
6.2.40~dfsg-4ubuntu0.20.04.1~esm1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Sympa version =>6.2.16 - Cross-Site Scripting |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1000671 is a medium vulnerability (CVSS 6.1) in Sympa, published September 6, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.44%, the 89th percentile. Fixed in sympa 6.2.36~dfsg-1.