Vulnerability Details : CVE-2004-1177
Cross-site scripting (XSS) vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not properly escaped in the resulting error page.
Vulnerability category: Cross site scripting (XSS)
Exploit prediction scoring system (EPSS) score for CVE-2004-1177
Probability of exploitation activity in the next 30 days: 0.39%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 71 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2004-1177
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
Vendor statements for CVE-2004-1177
-
Red Hat 2006-08-30This issue did not affect the versions of mailman shipped with Red Hat Enterprise Linux 2.1, 3, or 4. In addition, we believe this issue does not apply to the 2.0.x versions of mailman due to setting of STEALTH_MODE
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11113
404 Not Found
-
http://www.debian.org/security/2005/dsa-674
Debian -- Security Information -- DSA-674-3 mailmanPatch;Vendor Advisory
-
http://www.redhat.com/support/errata/RHSA-2005-235.html
Support
-
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=287555
#287555 - [CAN-2004-1177] cross-site scripting in scripts/driver - Debian Bug report logsPatch
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/18854
GNU Mailman "script/driver" cross-site scripting CVE-2004-1177 Vulnerability Report
-
http://www.mandriva.com/security/advisories?name=MDKSA-2005:015
Page not found - Mandriva.com
-
http://www.novell.com/linux/security/advisories/2005_07_mailman.html
404 Page Not Found | SUSE
-
http://marc.info/?l=bugtraq&m=110549296126351&w=2
'[USN-59-1] mailman vulnerabilities' - MARC
- cpe:2.3:a:gnu:mailman:2.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:2.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:1.1:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:2.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:2.1:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:2.0.13:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:2.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:2.0:beta5:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:2.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:2.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:2.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:2.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:2.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:2.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:2.1b1:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:2.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:2.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:mailman:2.1.4:*:*:*:*:*:*:*