PT-2006-5339 · Lyris · Lyris Listmanager

Published 2006-09-06 · Updated 2018-10-17 · CVE-2006-4546

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Lyris ListManager version 8.95

Description The issue allows remote authenticated users with administrative privileges for at least one list on the server to add new administrators to any list. This is achieved by modifying the MEMBERS .List parameter.

Recommendations For Lyris ListManager version 8.95, consider restricting access to administrative privileges to minimize the risk of exploitation. As a temporary workaround, restrict the ability to modify the MEMBERS .List parameter until a patch is available.

Fix

Related Identifiers

CVE-2006-4546

Affected Products

Lyris Listmanager

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2006-4546 · Security Note
• http://secunia.com/advisories/21698 · Note
• http://securitytracker.com/id?1016771 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28679 · Note
• http://securityfocus.com/archive/1/444844/100/0/threaded · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0817.html · Note
• http://securityreason.com/securityalert/1502 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4546 · Note