Description


A reflected cross-site scripting (XSS) vulnerability in the LISTSERV 17 web interface allows remote attackers to inject arbitrary JavaScript or HTML via the "c" parameter.


To reproduce, please visit


http://localhost/scripts/wa.exe?TICKET=test&c=%3Cscript%3Ealert(1)%3C/script%3E


(or whichever URL you can use for testing instead of localhost).


The "c" parameter will reflect any value given onto the page.


https://nvd.nist.gov/vuln/detail/CVE-2022-39195 

Mitigation


This vulnerability can be mitigated by going under "Server Administration" to "Web Templates" and editing the BODY-LCMD-MESSAGE web template. Change any instance of &+CMD; to &+HTMLENCODE(&+CMD;); .