CVE-2011-1524

Symantec LiveUpdate Administrator <2.3 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in the management login GUI page in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to inject arbitrary web script or HTML via the username field, as demonstrated by injecting an IFRAME element into the event log, a different vulnerability than CVE-2011-0545.

Exploits (1)

exploitdb WORKING POC

by Nikolas Sotiriu · textwebappswindows

https://www.exploit-db.com/exploits/17026

View Code ZIP pw:eip

References (9)

[Exploit] http://securitytracker.com/id?1025242

[Exploit] http://sotiriu.de/adv/NSOADV-2011-001.txt

[Exploit] http://www.exploit-db.com/exploits/17026

[Exploit] http://www.securityfocus.com/bid/46856

[Third Party Advisory] http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110321_00

[Vendor Advisory] http://www.vupen.com/english/advisories/2011/0727

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/66213

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/517109/100/0/threaded

[Third Party Advisory] http://securityreason.com/securityalert/8166

Scores

EPSS 0.2054

EPSS Percentile 95.5%

Classification

CWE

CWE-79

Status published

Affected Products (7)

symantec/liveupdate_administrator < 2.2.2.9

symantec/liveupdate_administrator

symantec/liveupdate_administrator

symantec/liveupdate_administrator

symantec/liveupdate_administrator

symantec/liveupdate_administrator

n/a/n/a

Timeline

Published Mar 28, 2011

Tracked Since Feb 18, 2026