CVE-2002-0855 in Mailman
Summary
by MITRE
Cross-site scripting vulnerability in Mailman before 2.0.12 allows remote attackers to execute script as other users via a subscriber s list subscription options in the (1) adminpw or (2) info parameters to the ml-name feature.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/13/2025
The vulnerability described in CVE-2002-0855 represents a critical cross-site scripting flaw within the Mailman mailing list management system prior to version 2.0.12. This vulnerability exists in the handling of user input within the ml-name feature, specifically affecting the adminpw and info parameters that control subscriber list subscription options. The flaw allows remote attackers to inject malicious scripts into the system that would execute in the context of other users' browsers, potentially leading to unauthorized actions and data compromise.
The technical implementation of this vulnerability stems from inadequate input validation and output sanitization within the Mailman application's web interface. When users attempt to access mailing list subscription options through the ml-name feature, the system fails to properly escape or filter user-supplied data in the adminpw and info parameters. This creates an environment where attacker-controlled input can be interpreted as executable code by web browsers, enabling the execution of malicious scripts in the victim's browser context. The vulnerability operates at the application layer and specifically targets the web-based administrative interface of the mailing list manager.
The operational impact of this vulnerability extends beyond simple script execution, as it can enable attackers to perform a range of malicious activities within the compromised user sessions. An attacker could potentially steal session cookies, modify mailing list configurations, access private mailing list content, or even escalate privileges within the Mailman system. The vulnerability affects any user who interacts with the affected ml-name feature, making it particularly dangerous in environments where multiple users manage or subscribe to mailing lists. The remote nature of the attack means that exploitation does not require physical access to the system or local network presence, making it highly accessible to external threat actors.
Security professionals should consider this vulnerability in the context of CWE-79, which specifically addresses cross-site scripting flaws in software applications. The attack vector aligns with the ATT&CK framework's technique T1059.007 for command and script injection, as the vulnerability enables attackers to inject and execute malicious scripts within user browsers. Organizations should implement immediate mitigations including upgrading to Mailman version 2.0.12 or later, which contains the necessary input validation patches. Additionally, administrators should consider implementing additional security measures such as input sanitization at the web application firewall level and monitoring for suspicious parameter values in the ml-name feature. Regular security assessments and vulnerability scanning should be conducted to identify similar issues in other web applications within the organization's infrastructure.