CVE-2016-6893

8.8 highEPSS 1.6%

Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 1.6% chance of exploitation in the next 30 days; higher than 75% of CVEs (scores of 2026-10-31)
CWE: CWE-352
Published: 2016-09-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

gnu:mailman

References

http://www.debian.org/security/2016/dsa-3668
http://www.securityfocus.com/bid/92731
http://www.securitytracker.com/id/1036728
https://bugs.launchpad.net/bugs/1614841
http://www.debian.org/security/2016/dsa-3668

Check your stack JSON