dbcve.org
List ManagerApplication · Lyris

CVE-2006-4546

MEDIUM · 6.5 CVSS v2.0 Published 2006-09-06
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
71/100
Remediation priority · Elevated
Remotely reachable Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Lyris ListManager 8.95 allows remote authenticated users, who have administrative privileges for at least one list on the server, to add new administrators to any list via a modified MEMBERS_.List_ parameter.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Lyris ListManager 8.95 contains an insecure direct object reference vulnerability where an authenticated administrator of one mailing list can manipulate the MEMBERS_.List_ parameter to add themselves as an administrator to other lists on the server, achieving privilege escalation from single-list admin to server-wide admin access.

MitigationRestrict network access to the ListManager administrative interface to minimize exposure; review existing admin accounts for unauthorized additions; if a vendor patch exists, apply it promptly.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
List ManagerApplication
Affected:= 8.95

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial

AV:N/AC:L/Au:S/C:P/I:P/A:P

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify Lyris ListManager installation and version
    Locate the ListManager installation directory and check the version file or executable properties. Common locations include C:\Lyris\ListManager or /usr/local/listmanager. Look for version information in the main executable, a version.txt file, or the administrative web interface footer.
    Affected if The installed version is exactly 8.95 and the web administrative interface is accessible on the server.
  2. Determine if multiple mailing lists exist
    Log into the ListManager administrative interface as a list administrator. Navigate to the list management section to enumerate all mailing lists configured on the server. Alternatively, check the underlying database or configuration files for multiple list definitions.
    Affected if More than one mailing list is configured on the server, creating the condition where the MEMBERS_.List_ parameter can be manipulated to target other lists.
  3. Verify administrative access to the web interface
    Confirm that the ListManager web administrative interface is accessible over the network. Check if HTTP/HTTPS ports (typically 2300 or 80/443) are listening and reachable.
    Affected if The administrative interface is network-accessible, enabling the attack vector where the MEMBERS_.List_ parameter manipulation can be performed.
  4. Review all server-wide administrator accounts
    Access the global admin panel in ListManager to view all server-level administrator accounts. Compare the current list of admin accounts against documented or expected administrators. Look for accounts that should not have server-wide admin privileges.
    Affected if Any administrative account exists that was not intentionally created or that has privileges to manage lists other than the account owner's assigned list.
  5. Check for privilege escalation indicators
    Examine the MEMBERS_.List_ parameter handling in web requests. As a single-list admin, attempt to access or modify settings for a different mailing list using the MEMBERS_.List_ parameter. Observe if the parameter allows cross-list manipulation.
    Affected if The MEMBERS_.List_ parameter can be manipulated by a list-specific admin to access or modify configuration of other mailing lists on the server.

A user is affected if Lyris ListManager version 8.95 is installed, the web administrative interface is network-accessible, multiple mailing lists exist on the server, and an unauthorized escalation of privileges to server-wide admin access has occurred via the MEMBERS_.List_ parameter.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Restrict network access to the ListManager administrative interface to minimize exposure; review existing admin accounts for unauthorized additions; if a vendor patch exists, apply it promptly.

Fix this in List Manager Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing6.0 h
  • Review / QA4.0 h
22.0 hours of engineering $3,860
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,176.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2006-4546 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2006-4546 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data