Description
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman (aka the private archive authentication endpoint) via the username parameter.
Remediation
References
Related Vulnerabilities
Joomla! Core 1.7.x Security Bypass (1.7.0 - 1.7.2)
WordPress Plugin WP Idea Stream Cross-Site Scripting (2.1.1)
WordPress Plugin WPML (WordPress Multilingual) Multiple Vulnerabilities (3.1.8.6)
Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-2359)
Python Integer Overflow or Wraparound Vulnerability (CVE-2015-1283)