CVE-2011-1524
Cross-site scripting (XSS) vulnerability in the management login GUI page in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to inject arbitrary web script or HTML via the username field, as demonstrated by injecting an IFRAME…
Does this matter?
Lower severity and a low EPSS score (4.21%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in the management login GUI page in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to inject arbitrary web script or HTML via the username field, as demonstrated by injecting an IFRAME element into the event log, a different vulnerability than CVE-2011-0545.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 4.21% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- symantec/liveupdate administrator
- Source
- cve@mitre.org
References
- http://securityreason.com/securityalert/8166
- http://securitytracker.com/id?1025242Exploit
- http://sotiriu.de/adv/NSOADV-2011-001.txtExploit
- http://www.exploit-db.com/exploits/17026Exploit
- http://www.securityfocus.com/archive/1/517109/100/0/threaded
- http://www.securityfocus.com/bid/46856Exploit
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110321_00
- http://www.vupen.com/english/advisories/2011/0727Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66213
- http://securityreason.com/securityalert/8166
- http://securitytracker.com/id?1025242Exploit
- http://sotiriu.de/adv/NSOADV-2011-001.txtExploit
- http://www.exploit-db.com/exploits/17026Exploit
- http://www.securityfocus.com/archive/1/517109/100/0/threaded
- http://www.securityfocus.com/bid/46856Exploit
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110321_00
- http://www.vupen.com/english/advisories/2011/0727Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66213
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.