Cross-Site Request Forgery in GNU Mailman Postorius Affects User Subscription Management
CVE-2021-40347

5.4MEDIUM

Key Information:

Vendor: Postorius Project
Status: Postorius
Vendor: CVE Published:; 10 September 2021

🔔 Create Postorius Project Vulnerability Alert

What is CVE-2021-40347?

A security issue was identified in GNU Mailman Postorius before version 1.3.5 that allows an authenticated attacker to send malicious POST requests, leading to unauthorized unsubscriptions from mailing lists. This flaw potentially exposes sensitive information about the subscription status of users, as an attacker can determine whether a specific email address is subscribed to a mailing list. Proper security measures must be implemented to safeguard against such exploits.