CVE-2021-43331
In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute...
In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.
- Record
CVE-2021-43331- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.
- Record
CVE-2021-43331- Updated
- 2026-11-02
EUVDEUVD-2021-30269 No score
In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.
- Record
EUVD-2021-30269- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-25r6-8rph-4cc3
In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute...
In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.
- Record
GHSA-25r6-8rph-4cc3- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVOESA-2021-1444
mailman security update
Mailman is free software for managing electronic mail discussion and e-newsletter lists. Mailman is integrated with the web, making it easy for users to manage their accounts and for list owners to administer their lists. Mailman supports built-in archiving, automatic bounce processing, content filtering, digest delivery, spam filters, and more.
Security Fix(es):
In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack.(CVE-2021-43332)
In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.(CVE-2021-43331)
- Record
OESA-2021-1444- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2022-1931
mailman security update
Mailman is free software for managing electronic mail discussion and e-newsletter lists. Mailman is integrated with the web, making it easy for users to manage their accounts and for list owners to administer their lists. Mailman supports built-in archiving, automatic bounce processing, content filtering, digest delivery, spam filters, and more.
Security Fix(es):
In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack.(CVE-2021-43332)
In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.(CVE-2021-43331)
In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.(CVE-2021-44227)
- Record
OESA-2022-1931- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2021-43331
In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.
- Record
UBUNTU-CVE-2021-43331- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVSUSE-SU-2022:1886-1 No score
Security update for mailman
This update for mailman fixes the following issues:
- CVE-2021-44227: Preventing list moderator or list member accessing the admin UI (bsc#1193316).
- CVE-2021-43332: Preventing list moderator from cracking the list admin password encrypted in a CSRF token (bsc#1192741).
- CVE-2021-43331: Fixed XSS in Cgi/options.py (bsc#1192735).
- CVE-2021-42096: Add protection against remote privilege escalation via csrf_token derived from admin password (bsc#1191959).
- Record
SUSE-SU-2022:1886-1- Updated
- 2026-11-02
OSVUSN-5151-1 No score
mailman vulnerabilities
It was discovered that Mailman incorrectly handled certain URL. An attacker could possibly use this issue to execute arbitrary code. (CVE-2021-43331)
It was discovered that Mailman incorrectly handled certain inputs. An attacker could possibly use this issue to expose sensitive information. (CVE-2021-43332)
- Record
USN-5151-1- Updated
- 2026-11-02
OSVUSN-5151-2 No score
mailman vulnerabilities
USN-5151-1 fixed several vulnerabilities in Mailman. This update provides the corresponding update for Ubuntu 20.04 ESM.
Original advisory details:
It was discovered that Mailman incorrectly handled certain URL. An attacker could possibly use this issue to execute arbitrary code. (CVE-2021-43331)
It was discovered that Mailman incorrectly handled certain inputs. An attacker could possibly use this issue to expose sensitive information. (CVE-2021-43332)
- Record
USN-5151-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mailmanDebian:9 From an advisory covering 3 CVEs |
before 1:2.1.23-1+deb9u8, plus listed versions 1:2.1.23-11:2.1.23-1+deb9u11:2.1.23-1+deb9u21:2.1.23-1+deb9u31:2.1.23-1+deb9u41:2.1.23-1+deb9u51:2.1.23-1+deb9u61:2.1.23-1+deb9u7 |
1:2.1.23-1+deb9u8 |
mailmanopenEuler:20.03-LTS-SP1 From an advisory covering 2 CVEs |
before 2.1.36-1.oe1 | 2.1.36-1.oe1 |
mailmanopenEuler:20.03-LTS-SP2 From an advisory covering 2 CVEs |
before 2.1.36-1.oe1 | 2.1.36-1.oe1 |
mailmanopenEuler:20.03-LTS-SP3 From an advisory covering 3 CVEs |
before 2.1.36-2.oe1 | 2.1.36-2.oe1 |
mailmanSUSE:HPE Helion OpenStack 8 From an advisory covering 4 CVEs |
before 2.1.17-3.26.1 | 2.1.17-3.26.1 |
mailmanSUSE:OpenStack Cloud 8 From an advisory covering 4 CVEs |
before 2.1.17-3.26.1 | 2.1.17-3.26.1 |
mailmanSUSE:OpenStack Cloud 9 From an advisory covering 4 CVEs |
before 2.1.17-3.26.1 | 2.1.17-3.26.1 |
mailmanSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 4 CVEs |
before 2.1.17-3.26.1 | 2.1.17-3.26.1 |
mailmanSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 4 CVEs |
before 2.1.17-3.26.1 | 2.1.17-3.26.1 |
mailmanSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 4 CVEs |
before 2.1.17-3.26.1 | 2.1.17-3.26.1 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mailmanSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 4 CVEs |
before 2.1.17-3.26.1 | 2.1.17-3.26.1 |
mailmanSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 4 CVEs |
before 2.1.17-3.26.1 | 2.1.17-3.26.1 |
mailmanSUSE:Linux Enterprise Server 12 SP3-LTSS From an advisory covering 4 CVEs |
before 2.1.17-3.26.1 | 2.1.17-3.26.1 |
mailmanSUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 4 CVEs |
before 2.1.17-3.26.1 | 2.1.17-3.26.1 |
mailmanSUSE:Linux Enterprise Server 12 SP4-LTSS From an advisory covering 4 CVEs |
before 2.1.17-3.26.1 | 2.1.17-3.26.1 |
mailmanSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 4 CVEs |
before 2.1.17-3.26.1 | 2.1.17-3.26.1 |
mailmanSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 4 CVEs |
before 2.1.17-3.26.1 | 2.1.17-3.26.1 |
mailmanUbuntu:Pro:16.04:LTS |
before 1:2.1.20-1ubuntu0.6+esm2, plus listed versions 1:2.1.20-11:2.1.20-1ubuntu0.11:2.1.20-1ubuntu0.31:2.1.20-1ubuntu0.41:2.1.20-1ubuntu0.51:2.1.20-1ubuntu0.61:2.1.20-1ubuntu0.6+esm1 |
1:2.1.20-1ubuntu0.6+esm2 |
mailmanUbuntu:18.04:LTS |
before 1:2.1.26-1ubuntu0.5, plus listed versions 1:2.1.23-11:2.1.24-11:2.1.25-11:2.1.26-11:2.1.26-1ubuntu0.11:2.1.26-1ubuntu0.21:2.1.26-1ubuntu0.31:2.1.26-1ubuntu0.4 |
1:2.1.26-1ubuntu0.5 |
mailmanUbuntu:Pro:20.04:LTS |
before 1:2.1.29-1ubuntu3.1+esm1, plus listed versions 1:2.1.29-11:2.1.29-1build11:2.1.29-1ubuntu31:2.1.29-1ubuntu3.1 |
1:2.1.29-1ubuntu3.1+esm1 |
mailmanUbuntu:Pro:16.04:LTS From an advisory covering 2 CVEs |
before 1:2.1.20-1ubuntu0.6+esm2, plus listed versions 1:2.1.20-11:2.1.20-1ubuntu0.11:2.1.20-1ubuntu0.31:2.1.20-1ubuntu0.41:2.1.20-1ubuntu0.51:2.1.20-1ubuntu0.61:2.1.20-1ubuntu0.6+esm1 |
1:2.1.20-1ubuntu0.6+esm2 |
mailmanUbuntu:18.04:LTS From an advisory covering 2 CVEs |
before 1:2.1.26-1ubuntu0.5, plus listed versions 1:2.1.23-11:2.1.24-11:2.1.25-11:2.1.26-11:2.1.26-1ubuntu0.11:2.1.26-1ubuntu0.21:2.1.26-1ubuntu0.31:2.1.26-1ubuntu0.4 |
1:2.1.26-1ubuntu0.5 |
mailmanUbuntu:Pro:20.04:LTS From an advisory covering 2 CVEs |
before 1:2.1.29-1ubuntu3.1+esm1, plus listed versions 1:2.1.29-11:2.1.29-1build11:2.1.29-1ubuntu31:2.1.29-1ubuntu3.1 |
1:2.1.29-1ubuntu3.1+esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-43331 is a medium vulnerability (CVSS 6.1) in Gnu Mailman, published November 12, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.38%, the 72nd percentile. Fixed in mailman 1:2.1.20-1ubuntu0.6+esm2.
References
bugs.launchpad.net/mailman/+bug/1949401
mail.python.org/archives/list/mailman-announce%40python.org/message/I2X7PSFXIEPLM3UMKZMGOEO3UFYETGRL
lists.debian.org/debian-lts-announce/2022/06/msg00011.html
nvd.nist.gov/vuln/detail/CVE-2021-43331
github.com/advisories/GHSA-25r6-8rph-4cc3
Show 20 moreShow less
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1444
suse.com/support/update/announcement/2022/suse-su-20221886-1
bugzilla.suse.com/1191959
ubuntu.com/security/CVE-2021-43331
cve.org/CVERecord?id=CVE-2021-43331
launchpad.net/bugs/1949401