GNU Mailman Postorius Access Control Issues

中 5.4CVE-2021-40347 · GHSA-v83x-78q3-gr2j · PYSEC-2021-319 · 10/09/2021 公開 · 17/06/2026 更新

要点

CVE-2021-40347 は postorius, postorius (postorius project) に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.2%（全脆弱性の 68.0% より高い）。
対処：1.3.5 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
postorius PyPI	`< 1.3.5`	`1.3.5`
postorius postorius_project	`< 1.3.5`	`1.3.5`

概要

An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.

NVD の説明

An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.