Description
Lyris ListManager 8.95 allows remote authenticated users, who have administrative privileges for at least one list on the server, to add new administrators to any list via a modified MEMBERS_.List_ parameter.
References
- 21698 third-party-advisory
- 1016771 vdb-entry
- 20060831 Lyris ListManager 8.95: Add arbitrary administrator to arbitrary list mailing-list
- 1502 third-party-advisory
- listmanager-administrator-security-bypass(28679) vdb-entry
- 20060831 Lyris ListManager 8.95: Add arbitrary administrator to arbitrary list mailing-list