Unrated severityNVD Advisory· Published Dec 10, 2005· Updated Apr 16, 2026
CVE-2005-4142
CVE-2005-4142
Description
The web interface for subscribing new users in Lyris ListManager 5.0 through 8.8b, in combination with a line wrap feature, allows remote attackers to execute arbitrary list administration commands via LFCR (%0A%0D) sequences in the pw parameter. NOTE: it is not clear whether this is a variant of a CRLF injection vulnerability.
Affected products
5cpe:2.3:a:lyris_technologies_inc:listmanager:5.0:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:lyris_technologies_inc:listmanager:5.0:*:*:*:*:*:*:*
- cpe:2.3:a:lyris_technologies_inc:listmanager:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:lyris_technologies_inc:listmanager:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:lyris_technologies_inc:listmanager:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:lyris_technologies_inc:listmanager:8.8a:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
7- secunia.com/advisories/17943nvdPatchVendor Advisory
- metasploit.com/research/vulns/lyris_listmanager/nvdExploit
- archives.neohapsis.com/archives/fulldisclosure/2005-12/0349.htmlnvd
- www.osvdb.org/21547nvd
- www.securityfocus.com/archive/1/419077/100/0/threadednvd
- www.securityfocus.com/bid/15786nvd
- www.vupen.com/english/advisories/2005/2820nvd
News mentions
0No linked articles in our index yet.