Description
The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors.
References (8)
Core 8
Core References
Vendor Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2015:051
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/01/20/4
Patch, Vendor Advisory x_refsource_confirm
https://www.sympa.org/security_advisories
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/62387
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/72277
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/62442
Third Party Advisory x_refsource_confirm
http://advisories.mageia.org/MGASA-2015-0085.html
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2015/dsa-3134
Scores
EPSS
0.0244
EPSS Percentile
82.3%
Details
CWE
CWE-200
Status
published
Products (34)
sympa/sympa
6.0.0
sympa/sympa
6.0.1
sympa/sympa
6.0.2
sympa/sympa
6.0.3
sympa/sympa
6.0.4
sympa/sympa
6.0.5
sympa/sympa
6.0.6
sympa/sympa
6.0.7
sympa/sympa
6.0.8
sympa/sympa
6.0.9
... and 24 more
Published
Jan 22, 2015
Tracked Since
Feb 18, 2026