Security Advisory

CVE-2020-12137

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2020-04-24 12:37:58

Last updated 2024-08-04 11:48:58

Assigner mitre

State PUBLISHED

Description

GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code.

← Browse all CVEs View on cve.org ↗