CVE-2025-43921

Descripción

GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• https://code.launchpad.net/~mailman-coders/mailman/2.1 Product
• https://github.com/0NYX-MY7H/CVE-2025-43921 ExploitThird Party Advisory
• https://github.com/cpanel/mailman2-python3
• https://www.openwall.com/lists/oss-security/2025/04/21/6