Vulnerability Details : CVE-2011-1524
Cross-site scripting (XSS) vulnerability in the management login GUI page in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to inject arbitrary web script or HTML via the username field, as demonstrated by injecting an IFRAME element into the event log, a different vulnerability than CVE-2011-0545.
Vulnerability category: Cross site scripting (XSS)
Exploit prediction scoring system (EPSS) score for CVE-2011-1524
Probability of exploitation activity in the next 30 days: 0.94%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 83 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2011-1524
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2011-1524
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2011-1524
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/66213
Symantec LiveUpdate Administrator GUI cross-site request forgery CVE-2011-0545 Vulnerability Report
-
http://securitytracker.com/id?1025242
Symantec LiveUpdate Administrator Input Validation Flaw Permits Cross-Site Request Forgery Attacks - SecurityTrackerExploit
-
http://www.exploit-db.com/exploits/17026
Symantec LiveUpdate Administrator Management GUI - HTML Injection - Windows webapps ExploitExploit
-
http://www.securityfocus.com/bid/46856
Symantec LiveUpdate Administrator Management GUI HTML Injection VulnerabilityExploit
-
http://www.securityfocus.com/archive/1/517109/100/0/threaded
SecurityFocus
-
http://sotiriu.de/adv/NSOADV-2011-001.txt
Exploit
-
http://securityreason.com/securityalert/8166
Symantec LiveUpdate Administrator CSRF vulnerability - CXSecurity.com
-
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110321_00
Symantec LiveUpdate Administrator Cross-Site Request Forgery
-
http://www.vupen.com/english/advisories/2011/0727
Webmail | OVH- OVHVendor Advisory
Products affected by CVE-2011-1524
- cpe:2.3:a:symantec:liveupdate_administrator:*:*:*:*:*:*:*:*
- cpe:2.3:a:symantec:liveupdate_administrator:2.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:symantec:liveupdate_administrator:2.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:symantec:liveupdate_administrator:2.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:symantec:liveupdate_administrator:2.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:symantec:liveupdate_administrator:2.1.0:*:*:*:*:*:*:*