Thanks for the heads-up.
We always handle security reports with first priority. Usually prefer receiving them privately, so we can first check and issue proper reply or fix.
Anyway:
To make long story short:
CB and Subscribemailman plugin are NOT vulnerable to this issue.
Here the analysis of the implications:
I've reviewed the security fix of Snoopy 1.2.4.
It only sanitizes the URL of the POST request.
1) Subscribemailman:
I've reviewed Subscribemailman plugin's use of that URL, and it's only a backend parameter.
So, although the Snoopy 1.2.3 it includes (instead of using the CB library) is vulnerable to this, Subscribemailman is not vulnerable (except to wierd administrators with site backend access, but that gives them more power anyway).
So Subscribemailman available from the downloads area is not vulnerable.
2) CB:
CB has an improved version of Snoopy 1.2.3, and CB 1.2's improvements already include the security fix of Snoopy 1.2.4 in Snoopy 1.2.3 of CB 1.2, and a few more.
In addition, CB itself used Snoopy only for version check with fixed url.
So from very old CB 1.0 to latest CB 1.2, none is vulnerable to that.
As a general rule of good site maintenance, we always recommend using latest stable releases.
beat
