CVE-2011-1524 Cross-site scripting (XSS) vulnerability in the management login GUI page in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to inject arbitrary web script or HTML via the u...
MediumCVSS 4.3
EPSS 4.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in the management login GUI page in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to inject arbitrary web script or HTML via the username field, as demonstrated by injecting an IFRAME element into the event log, a different vulnerability than CVE-2011-0545.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| symantec liveupdate administrator | <= 2.2.2.9 | No fix listed |
| symantec liveupdate administrator | = 2.1.0 | No fix listed |
| symantec liveupdate administrator | = 2.1.2 | No fix listed |
| symantec liveupdate administrator | = 2.1.3 | No fix listed |
| symantec liveupdate administrator | = 2.2.1 | No fix listed |
| symantec liveupdate administrator | = 2.2.2 | No fix listed |
References
- 8166 third-party-advisory
- 1025242 exploit vdb-entry
- sotiriu.de exploit
- 17026 exploit
- 20110322 NSOADV-2011-001: Symantec LiveUpdate Administrator CSRF vulnerability mailing-list
- 46856 exploit vdb-entry
- www.symantec.com
- ADV-2011-0727 vdb-entry vendor-advisory
- symantec-lua-gui-csrf(66213) vdb-entry