CVE-2021-42097
GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not...
GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).
- Record
CVE-2021-42097- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 8.5 High
AV:N/AC:M/Au:S/C:C/I:C/A:C - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).
- Record
CVE-2021-42097- Updated
- 2026-11-02
EUVDEUVD-2021-29083 No score
GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).
- Record
EUVD-2021-29083- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vj65-f4hc-r425 No score
GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not...
GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).
- Record
GHSA-vj65-f4hc-r425- Weakness
- CWE-352
- Updated
- 2026-11-02
OSVOESA-2021-1405
mailman security update
Mailman is free software for managing electronic mail discussion and e-newsletter lists. Mailman is integrated with the web, making it easy for users to manage their accounts and for list owners to administer their lists. Mailman supports built-in archiving, automatic bounce processing, content filtering, digest delivery, spam filters, and more.
Security Fix(es):
/options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection.(CVE-2020-12108)
GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code.(CVE-2020-12137)
GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page.(CVE-2020-15011)
GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin password, and may be useful in conducting a brute-force attack against that password.(CVE-2021-42096)
GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).(CVE-2021-42097)
- Record
OESA-2021-1405- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:4826
Red Hat Security Advisory: mailman:2.1 security update
- Record
RHSA-2021:4826- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 11 moreShow less
OSVRHSA-2021:4837
Red Hat Security Advisory: mailman:2.1 security update
- Record
RHSA-2021:4837- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:4838
Red Hat Security Advisory: mailman:2.1 security update
- Record
RHSA-2021:4838- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:4839
Red Hat Security Advisory: mailman:2.1 security update
- Record
RHSA-2021:4839- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:4913
Red Hat Security Advisory: mailman security update
- Record
RHSA-2021:4913- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2021:4826
Important: mailman:2.1 security update
Mailman is a program used to help manage e-mail discussion lists.
Security Fix(es):
-
mailman: CSRF token bypass allows to perform CSRF attacks and account takeover (CVE-2021-42097)
-
mailman: CSRF token derived from admin password allows offline brute-force attack (CVE-2021-42096)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2021:4826- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-42097
GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).
- Record
UBUNTU-CVE-2021-42097- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2021:4826 No score
Important: mailman:2.1 security update
Mailman is a program used to help manage e-mail discussion lists.
Security Fix(es):
-
mailman: CSRF token bypass allows to perform CSRF attacks and account takeover (CVE-2021-42097)
-
mailman: CSRF token derived from admin password allows offline brute-force attack (CVE-2021-42096)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2021:4826- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1436-1 No score
Security update for mailman
This update for mailman fixes the following issues:
Update to 2.1.35 to fix 2 security issues:
-
A potential for for a list member to carry out an off-line brute force attack to obtain the list admin password has been reported by Andre Protas, Richard Cloke and Andy Nuttall of Apple. This is fixed. CVE-2021-42096 (boo#1191959, LP:#1947639)
-
A CSRF attack via the user options page could allow takeover of a users account. This is fixed. CVE-2021-42097 (boo#1191960, LP:#1947640)
-
make package build reproducible (boo#1047218)
- Record
openSUSE-SU-2021:1436-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1452-1 No score
Security update for mailman
This update for mailman fixes the following issues:
Update to 2.1.35 to fix 2 security issues:
-
A potential for for a list member to carry out an off-line brute force attack to obtain the list admin password has been reported by Andre Protas, Richard Cloke and Andy Nuttall of Apple. This is fixed. CVE-2021-42096 (boo#1191959, LP:#1947639)
-
A CSRF attack via the user options page could allow takeover of a users account. This is fixed. CVE-2021-42097 (boo#1191960, LP:#1947640)
-
make package build reproducible (boo#1047218)
This update was imported from the openSUSE:Leap:15.2:Update update project.
- Record
openSUSE-SU-2021:1452-1- Updated
- 2026-11-02
OSVUSN-5121-1 No score
mailman vulnerabilities
Andre Protas, Richard Cloke, and Andy Nuttall discovered that Mailman did not properly associate cross-site request forgery (CSRF) tokens to specific accounts. A remote attacker could use this to perform a CSRF attack to gain access to another account. (CVE-2021-42097)
Andre Protas, Richard Cloke, and Andy Nuttall discovered that Mailman's cross-site request forgery (CSRF) tokens for the options page are derived from the admin password. A remote attacker could possibly use this to assist in performing a brute force attack against the admin password. (CVE-2021-42096)
- Record
USN-5121-1- Updated
- 2026-11-02
OSVUSN-5121-2 No score
mailman vulnerabilities
USN-5009-1 fixed vulnerabilities in Mailman. This update provides the corresponding updates for Ubuntu 20.04 LTS. In addition, the following CVEs were fixed:
It was discovered that Mailman allows arbitrary content injection. An attacker could use this to inject malicious content. (CVE-2020-12108, CVE-2020-15011)
It was discovered that Mailman improperly sanitize the MIME content. An attacker could obtain sensitive information by sending a special type of attachment. (CVE-2020-12137)
Original advisory details:
Andre Protas, Richard Cloke, and Andy Nuttall discovered that Mailman did not properly associate cross-site request forgery (CSRF) tokens to specific accounts. A remote attacker could use this to perform a CSRF attack to gain access to another account. (CVE-2021-42097)
Andre Protas, Richard Cloke, and Andy Nuttall discovered that Mailman’s cross-site request forgery (CSRF) tokens for the options page are derived from the admin password. A remote attacker could possibly use this to assist in performing a brute force attack against the admin password. (CVE-2021-42096)
- Record
USN-5121-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mailmanAlmaLinux:8 From an advisory covering 2 CVEs |
before 3:2.1.29-12.module_el8.5.0+26+48d4c9ee.2 | 3:2.1.29-12.module_el8.5.0+26+48d4c9ee.2 |
mailmanAlmaLinux:8 From an advisory covering 2 CVEs |
before 3:2.1.29-12.module_el8.5.0+2601+e8845b76.1 | 3:2.1.29-12.module_el8.5.0+2601+e8845b76.1 |
mailmanAlmaLinux:8 From an advisory covering 2 CVEs |
before 3:2.1.29-12.module_el8.5.0+2602+327eb9f3.2 | 3:2.1.29-12.module_el8.5.0+2602+327eb9f3.2 |
mailmanDebian:9 From an advisory covering 2 CVEs |
before 1:2.1.23-1+deb9u7, plus listed versions 1:2.1.23-11:2.1.23-1+deb9u11:2.1.23-1+deb9u21:2.1.23-1+deb9u31:2.1.23-1+deb9u41:2.1.23-1+deb9u51:2.1.23-1+deb9u6 |
1:2.1.23-1+deb9u7 |
mailmanDebian:10 From an advisory covering 4 CVEs |
before 1:2.1.29-1+deb10u2, plus listed versions 1:2.1.29-11:2.1.29-1+deb10u1 |
1:2.1.29-1+deb10u2 |
mailmanopenEuler:20.03-LTS-SP1 From an advisory covering 5 CVEs |
before 2.1.29-8.oe1 | 2.1.29-8.oe1 |
mailmanopenEuler:20.03-LTS-SP2 From an advisory covering 5 CVEs |
before 2.1.29-8.oe1 | 2.1.29-8.oe1 |
mailmanRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 3:2.1.29-12.module+el8.5.0+13211+e8845b76.1 | 3:2.1.29-12.module+el8.5.0+13211+e8845b76.1 |
mailman-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 3:2.1.29-12.module+el8.5.0+13211+e8845b76.1 | 3:2.1.29-12.module+el8.5.0+13211+e8845b76.1 |
mailman-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 3:2.1.29-12.module+el8.5.0+13211+e8845b76.1 | 3:2.1.29-12.module+el8.5.0+13211+e8845b76.1 |
Show 23 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mailmanRed Hat:rhel_eus:8.2::appstream From an advisory covering 2 CVEs |
before 3:2.1.29-4.module+el8.2.0+13241+705a6aa4.3 | 3:2.1.29-4.module+el8.2.0+13241+705a6aa4.3 |
mailman-debuginfoRed Hat:rhel_eus:8.2::appstream From an advisory covering 2 CVEs |
before 3:2.1.29-4.module+el8.2.0+13241+705a6aa4.3 | 3:2.1.29-4.module+el8.2.0+13241+705a6aa4.3 |
mailman-debugsourceRed Hat:rhel_eus:8.2::appstream From an advisory covering 2 CVEs |
before 3:2.1.29-4.module+el8.2.0+13241+705a6aa4.3 | 3:2.1.29-4.module+el8.2.0+13241+705a6aa4.3 |
mailmanRed Hat:rhel_eus:8.1::appstream From an advisory covering 2 CVEs |
before 3:2.1.29-4.module+el8.1.0+13242+45286865.1 | 3:2.1.29-4.module+el8.1.0+13242+45286865.1 |
mailman-debuginfoRed Hat:rhel_eus:8.1::appstream From an advisory covering 2 CVEs |
before 3:2.1.29-4.module+el8.1.0+13242+45286865.1 | 3:2.1.29-4.module+el8.1.0+13242+45286865.1 |
mailman-debugsourceRed Hat:rhel_eus:8.1::appstream From an advisory covering 2 CVEs |
before 3:2.1.29-4.module+el8.1.0+13242+45286865.1 | 3:2.1.29-4.module+el8.1.0+13242+45286865.1 |
mailmanRed Hat:rhel_eus:8.4::appstream From an advisory covering 2 CVEs |
before 3:2.1.29-11.module+el8.4.0+13212+81332387.1 | 3:2.1.29-11.module+el8.4.0+13212+81332387.1 |
mailman-debuginfoRed Hat:rhel_eus:8.4::appstream From an advisory covering 2 CVEs |
before 3:2.1.29-11.module+el8.4.0+13212+81332387.1 | 3:2.1.29-11.module+el8.4.0+13212+81332387.1 |
mailman-debugsourceRed Hat:rhel_eus:8.4::appstream From an advisory covering 2 CVEs |
before 3:2.1.29-11.module+el8.4.0+13212+81332387.1 | 3:2.1.29-11.module+el8.4.0+13212+81332387.1 |
mailmanRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 3:2.1.15-30.el7_9.2 | 3:2.1.15-30.el7_9.2 |
mailman-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 3:2.1.15-30.el7_9.2 | 3:2.1.15-30.el7_9.2 |
mailmanRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs |
before 3:2.1.15-30.el7_9.2 | 3:2.1.15-30.el7_9.2 |
mailman-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs |
before 3:2.1.15-30.el7_9.2 | 3:2.1.15-30.el7_9.2 |
mailmanRocky Linux:8 From an advisory covering 2 CVEs |
before 3:2.1.29-12.module+el8.5.0+717+27fd1ba7.2 | 3:2.1.29-12.module+el8.5.0+717+27fd1ba7.2 |
mailmanRocky Linux:8 From an advisory covering 2 CVEs |
before 3:2.1.29-12.module+el8.5.0+703+19300c10 | 3:2.1.29-12.module+el8.5.0+703+19300c10 |
mailmanUbuntu:Pro:16.04:LTS |
before 1:2.1.20-1ubuntu0.6+esm1, plus listed versions 1:2.1.20-11:2.1.20-1ubuntu0.11:2.1.20-1ubuntu0.31:2.1.20-1ubuntu0.41:2.1.20-1ubuntu0.51:2.1.20-1ubuntu0.6 |
1:2.1.20-1ubuntu0.6+esm1 |
mailmanUbuntu:18.04:LTS |
before 1:2.1.26-1ubuntu0.4, plus listed versions 1:2.1.23-11:2.1.24-11:2.1.25-11:2.1.26-11:2.1.26-1ubuntu0.11:2.1.26-1ubuntu0.21:2.1.26-1ubuntu0.3 |
1:2.1.26-1ubuntu0.4 |
mailmanUbuntu:20.04:LTS |
before 1:2.1.29-1ubuntu3.1, plus listed versions 1:2.1.29-11:2.1.29-1build11:2.1.29-1ubuntu3 |
1:2.1.29-1ubuntu3.1 |
mailmanUbuntu:Pro:16.04:LTS From an advisory covering 2 CVEs |
before 1:2.1.20-1ubuntu0.6+esm1, plus listed versions 1:2.1.20-11:2.1.20-1ubuntu0.11:2.1.20-1ubuntu0.31:2.1.20-1ubuntu0.41:2.1.20-1ubuntu0.51:2.1.20-1ubuntu0.6 |
1:2.1.20-1ubuntu0.6+esm1 |
mailmanUbuntu:18.04:LTS From an advisory covering 2 CVEs |
before 1:2.1.26-1ubuntu0.4, plus listed versions 1:2.1.23-11:2.1.24-11:2.1.25-11:2.1.26-11:2.1.26-1ubuntu0.11:2.1.26-1ubuntu0.21:2.1.26-1ubuntu0.3 |
1:2.1.26-1ubuntu0.4 |
mailmanUbuntu:20.04:LTS From an advisory covering 5 CVEs |
before 1:2.1.29-1ubuntu3.1, plus listed versions 1:2.1.29-11:2.1.29-1build11:2.1.29-1ubuntu3 |
1:2.1.29-1ubuntu3.1 |
mailmanopenSUSE:Leap 15.2 From an advisory covering 2 CVEs |
before 2.1.35-lp152.7.6.1 | 2.1.35-lp152.7.6.1 |
mailmanSUSE:Package Hub 15 SP2 From an advisory covering 2 CVEs |
before 2.1.35-bp152.7.6.1 | 2.1.35-bp152.7.6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-42097 is a high vulnerability (CVSS 8.0) in Gnu Mailman, published October 21, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.33%, the 71st percentile. Fixed in mailman 1:2.1.20-1ubuntu0.6+esm1.
References
mail.python.org/archives/list/mailman-announce%40python.org/thread/IKCO6JU755AP5G5TKMBJL6IEZQTTNPDQ
bugs.launchpad.net/mailman/+bug/1947640
openwall.com/lists/oss-security/2021/10/21/4
debian.org/security/2021/dsa-4991
nvd.nist.gov/vuln/detail/CVE-2021-42097
Show 49 moreShow less
github.com/advisories/GHSA-vj65-f4hc-r425
errata.almalinux.org/8/ALSA-2021-4826.html
vulners.com/cve/CVE-2021-42096
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1405
access.redhat.com/errata/RHSA-2021:4826
bugzilla.redhat.com/show_bug.cgi?id=2020568
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4826.json
cve.org/CVERecord?id=CVE-2021-42096
errata.rockylinux.org/RLSA-2021:4826
ubuntu.com/security/CVE-2021-42097
lists.opensuse.org/archives/list/[email protected]/thread/DSDRER3UF4R57ILYOQY7J63PNAP2LA73
bugzilla.suse.com/1047218
suse.com/security/cve/CVE-2021-42096