CVE-2021-34337
Mailman Core vulnerable to timing attacks
6.3
MEDIUM
CVSS 3.1
EPSS 0.30%
描述
An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.
如何修補 CVE-2021-34337
要修補 CVE-2021-34337,請將受影響套件升級到下列已修補版本。
- —未列出修補版本
- —升級至 3.3.5 或更新版本
- —升級至 e4a39488c4510fcad8851217f10e7337a196bb51 或更新版本
CVE-2021-34337 正在被利用嗎?
低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。
受影響套件(3)
- from 0
- from 0, < 3.3.5
- from 0, < e4a39488c4510fcad8851217f10e7337a196bb51 | from 0, < 3.3.5
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| osv | CVSS 3.1 | MEDIUM6.3 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N |