Sympa 3.2

CPE Details

Sympa 3.2
sympa
sympa
3.2
2008-09-05
18h03 +00:00
2012-06-15
14h28 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:sympa:sympa:3.2:*:*:*:*:*:*:*

Informations

Vendor

sympa

Product

sympa

Version

3.2

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2021-46900 2023-12-30 23h00 +00:00 Sympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an unpredictable value. Specifically, the cookie parameter is both a salt for stored passwords and an XSS protection mechanism.
7.5
Haute
CVE-2020-29668 2020-12-10 06h53 +00:00 Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.
3.7
Bas
CVE-2020-26932 2020-10-10 15h57 +00:00 debian/sympa.postinst for the Debian Sympa package before 6.2.40~dfsg-7 uses mode 4755 for sympa_newaliases-wrapper, whereas the intended permissions are mode 4750 (for access by the sympa group)
4.3
Moyen
CVE-2020-26880 2020-10-07 15h33 +00:00 Sympa through 6.2.57b.2 allows a local privilege escalation from the sympa user account to full root access by modifying the sympa.conf configuration file (which is owned by sympa) and parsing it through the setuid sympa_newaliases-wrapper executable.
7.8
Haute
CVE-2020-10936 2020-05-27 15h38 +00:00 Sympa before 6.2.56 allows privilege escalation.
7.8
Haute
CVE-2018-1000550 2018-06-26 14h00 +00:00 The Sympa Community Sympa version prior to version 6.2.32 contains a Directory Traversal vulnerability in wwsympa.fcgi template editing function that can result in Possibility to create or modify files on the server filesystem. This attack appear to be exploitable via HTTP GET/POST request. This vulnerability appears to have been fixed in 6.2.32.
9.8
Critique
CVE-2012-2352 2012-05-31 15h00 +00:00 The archive management (arc_manage) page in wwsympa/wwsympa.fcgi.in in Sympa before 6.1.11 does not check permissions, which allows remote attackers to list, read, and delete arbitrary list archives via vectors related to the (1) do_arc_manage, (2) do_arc_download, or (3) do_arc_delete functions.
7.5
CVE-2008-1648 2008-04-02 15h00 +00:00 Sympa before 5.4 allows remote attackers to cause a denial of service (daemon crash) via an e-mail message with a malformed value of the Content-Type header and unspecified other headers. NOTE: some of these details are obtained from third party information.
5