Sympa is a mail-list management system deployed across academic, research, and organizational infrastructure, where its modestly represented vulnerability footprint reflects the security demands of privileged access and user data handling. The vendor's disclosures recur around authentication and access-control weaknesses—improper privilege management, authentication bypasses, sensitive information exposure, and path-traversal issues—alongside input-validation flaws that are typical of web-based administration interfaces; these weakness classes frequently acquire public exploit code. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Sympa over time
Signals from CVEs in this vendor scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-1000671MEDIUM sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The "referer" parameter of the wwsympa.fcgi login action. th | Sep 6, 2018 | 6.1 | 32 | NO | YES |
CVE-2018-1000550CRITICAL The Sympa Community Sympa version prior to version 6.2.32 contains a Directory Traversal vulnerability in wwsympa.fcgi template editing function that can result in Possibility to c | Jun 26, 2018 | 9.8 | 28 | NO | NO |
CVE-2020-10936HIGH Sympa before 6.2.56 allows privilege escalation. | May 27, 2020 | 7.8 | 26 | NO | NO |
CVE-2020-26880HIGH Sympa through 6.2.57b.2 allows a local privilege escalation from the sympa user account to full root access by modifying the sympa.conf configuration file (which is owned by sympa) | Oct 7, 2020 | 7.8 | 25 | NO | NO |
CVE-2020-9369HIGH Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flood of notifications to listmasters) via a series o | Feb 24, 2020 | 7.5 | 25 | NO | NO |
CVE-2012-2352HIGH The archive management (arc_manage) page in wwsympa/wwsympa.fcgi.in in Sympa before 6.1.11 does not check permissions, which allows remote attackers to list, read, and delete arbit | May 31, 2012 | 7.5 | 25 | NO | NO |
CVE-2004-1735MEDIUM Cross-site scripting (XSS) vulnerability in the create list option in Sympa 4.1.x and earlier allows remote authenticated users to inject arbitrary web script or HTML via the descr | Aug 21, 2004 | 4.3 | 21 | NO | YES |
CVE-2021-46900HIGH Sympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an unpredictable value. Specifically, the c | Dec 31, 2023 | 7.5 | 19 | NO | NO |
CVE-2020-26932MEDIUM debian/sympa.postinst for the Debian Sympa package before 6.2.40~dfsg-7 uses mode 4755 for sympa_newaliases-wrapper, whereas the intended permissions are mode 4750 (for access by t | Oct 10, 2020 | 4.3 | 18 | NO | NO |
CVE-2008-4476MEDIUM sympa.pl in sympa 5.3.4 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/sympa_aliases.$$ temporary file. NOTE: wwsympa.fcgi was also reported, but | Oct 7, 2008 | 6.9 | 18 | NO | NO |
Signals from CVEs in this vendor scope (13 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Sympa.
Media articles that mention a CVE ID that affects a product developed by Sympa — matched by CVE ID, not by vendor name.