GHSA-rh6c-jh4c-9fg3 · Severity: medium · Ecosystem: pip — mailman Cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not properly escaped in the resulting error page.
Conclusion & alert: CVE-2004-1177 is rated Moderate Risk (43.8/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 1.78%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 1.58% | 1.78% | +0.20% |
| 2 | 2025-03-30 | 3.52% | 1.58% | -1.94% |
| 3 | 2025-03-29 | — | 3.52% | — |
Full EPSS history (7 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 4.3 | 2.0 | MEDIUM |
|
8.6 | 2.9 | [email protected] |
GHSA-rh6c-jh4c-9fg3 · Severity: medium · Ecosystem: pip — mailman Cross-site scripting (XSS) vulnerability
| vendor | priority | summary | link |
|---|---|---|---|
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2004-1177 |
ubuntu
|
medium | CVE-2004-1177 medium priority: Ubuntu including 1 source packages (mailman), 4 status rows across 4 suites (dapper, edgy, feisty, upstream): released 3, needs-triage 1. | https://ubuntu.com/security/CVE-2004-1177 |
This issue did not affect the versions of mailman shipped with Red Hat Enterprise Linux 2.1, 3, or 4. In addition, we believe this issue does not apply to the 2.0.x versions of mailman due to setting of STEALTH_MODE
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| gnu | mailman | 1.0 | cpe:2.3:a:gnu:mailman:1.0:*:*:*:*:*:*:* |
| gnu | mailman | 1.1 | cpe:2.3:a:gnu:mailman:1.1:*:*:*:*:*:*:* |
| gnu | mailman | 2.0 | cpe:2.3:a:gnu:mailman:2.0:*:*:*:*:*:*:* |
| gnu | mailman | 2.0 | cpe:2.3:a:gnu:mailman:2.0:beta3:*:*:*:*:*:* |
| gnu | mailman | 2.0 | cpe:2.3:a:gnu:mailman:2.0:beta4:*:*:*:*:*:* |
| gnu | mailman | 2.0 | cpe:2.3:a:gnu:mailman:2.0:beta5:*:*:*:*:*:* |
| gnu | mailman | 2.0.1 | cpe:2.3:a:gnu:mailman:2.0.1:*:*:*:*:*:*:* |
| gnu | mailman | 2.0.2 | cpe:2.3:a:gnu:mailman:2.0.2:*:*:*:*:*:*:* |
| gnu | mailman | 2.0.3 | cpe:2.3:a:gnu:mailman:2.0.3:*:*:*:*:*:*:* |
| gnu | mailman | 2.0.4 | cpe:2.3:a:gnu:mailman:2.0.4:*:*:*:*:*:*:* |
| gnu | mailman | 2.0.5 | cpe:2.3:a:gnu:mailman:2.0.5:*:*:*:*:*:*:* |
| gnu | mailman | 2.0.6 | cpe:2.3:a:gnu:mailman:2.0.6:*:*:*:*:*:*:* |
| gnu | mailman | 2.0.7 | cpe:2.3:a:gnu:mailman:2.0.7:*:*:*:*:*:*:* |
| gnu | mailman | 2.0.8 | cpe:2.3:a:gnu:mailman:2.0.8:*:*:*:*:*:*:* |
| gnu | mailman | 2.0.9 | cpe:2.3:a:gnu:mailman:2.0.9:*:*:*:*:*:*:* |
| gnu | mailman | 2.0.10 | cpe:2.3:a:gnu:mailman:2.0.10:*:*:*:*:*:*:* |
| gnu | mailman | 2.0.11 | cpe:2.3:a:gnu:mailman:2.0.11:*:*:*:*:*:*:* |
| gnu | mailman | 2.0.12 | cpe:2.3:a:gnu:mailman:2.0.12:*:*:*:*:*:*:* |
| gnu | mailman | 2.0.13 | cpe:2.3:a:gnu:mailman:2.0.13:*:*:*:*:*:*:* |
| gnu | mailman | 2.1 | cpe:2.3:a:gnu:mailman:2.1:*:*:*:*:*:*:* |
| gnu | mailman | 2.1.1 | cpe:2.3:a:gnu:mailman:2.1.1:*:*:*:*:*:*:* |
| gnu | mailman | 2.1.2 | cpe:2.3:a:gnu:mailman:2.1.2:*:*:*:*:*:*:* |
| gnu | mailman | 2.1.3 | cpe:2.3:a:gnu:mailman:2.1.3:*:*:*:*:*:*:* |
| gnu | mailman | 2.1.4 | cpe:2.3:a:gnu:mailman:2.1.4:*:*:*:*:*:*:* |
| gnu | mailman | 2.1b1 | cpe:2.3:a:gnu:mailman:2.1b1:*:*:*:*:*:*:* |