GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.
References
| Link | Resource |
|---|---|
| https://code.launchpad.net/~mailman-coders/mailman/2.1 | Product |
| https://github.com/0NYX-MY7H/CVE-2025-43921 | Exploit Third Party Advisory |
| https://github.com/cpanel/mailman2-python3 | |
| https://www.openwall.com/lists/oss-security/2025/04/21/6 |
Configurations
History
28 Apr 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| Summary | (en) GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used. |
24 Apr 2025, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
|
| First Time |
Gnu mailman
Gnu |
|
| CPE | cpe:2.3:a:gnu:mailman:*:*:*:*:*:*:*:* | |
| References | () https://code.launchpad.net/~mailman-coders/mailman/2.1 - Product | |
| References | () https://github.com/0NYX-MY7H/CVE-2025-43921 - Exploit, Third Party Advisory |
20 Apr 2025, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-04-20 01:15
Updated : 2025-04-28 14:15
NVD link : CVE-2025-43921
Mitre link : CVE-2025-43921
CVE.ORG link : CVE-2025-43921
JSON object : View
Products Affected
gnu
- mailman
CWE
CWE-863
Incorrect Authorization