Analyst readout for executives and security teams
Plain-English summary
This is an authenticated stored XSS issue in Sympa’s list-creation workflow. A logged-in user who can create a mailing list could put script or HTML in the description field, potentially affecting people who later view that content in the web interface. The sources do not show active exploitation.
Executive priority
Prioritize remediation if Sympa is internet-accessible or broad internal users can create lists. For modern environments, the main task is confirming the obsolete affected version is not still present.
Technical view
CVE-2004-1735 affects Sympa 4.1.x and earlier. The create-list option did not adequately prevent web script or HTML injection through the description field, allowing remote authenticated users to inject content into the application context. The source bundle does not provide CVSS, CWE, patch details, or proof of exploitation.
Likely exposure
Exposure is likely limited to organizations still running Sympa 4.1.x or earlier, especially where authenticated users can create lists or edit list descriptions through the web interface.
Exploitation context
The CVE requires authentication and access to the create-list path. There is no KEV listing and no cited source in the bundle stating active exploitation. Business impact depends on who can create lists and who later views injected descriptions.
Researcher notes
The public bundle is sparse: affected range, vector, and field are known, but severity scoring, root cause details, and fixed-version data are absent. Treat validation as configuration and version confirmation, not exploit reproduction.
Mitigation direction
- Check current Sympa or package-maintainer guidance for fixed versions.
- Upgrade or retire Sympa 4.1.x and earlier where present.
- Restrict list creation to trusted administrators until remediated.
- Review web-interface input handling for description fields.
- Monitor for unexpected list creations or suspicious descriptions.
Validation and detection
- Inventory Sympa deployments and confirm exact versions.
- Verify whether authenticated users can create mailing lists.
- Review existing list descriptions for unexpected HTML or script content.
- Confirm descriptions are safely encoded in the deployed web interface.
- Check logs for unusual list creation or description changes.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2004-1735 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- 10992CVE reference · vdb-entry, x_refsource_BID
- sympa-description-xss(17057)CVE reference · vdb-entry, x_refsource_XF
- 20040820 Cross Site Scripting Vulnerability in SympaCVE reference · mailing-list, x_refsource_BUGTRAQ
- 12339CVE reference · third-party-advisory, x_refsource_SECUNIA
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.