CVE-2011-1524

Description

Cross-site scripting (XSS) vulnerability in the management login GUI page in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to inject arbitrary web script or HTML via the username field, as demonstrated by injecting an IFRAME element into the event log, a different vulnerability than CVE-2011-0545.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/66213

http://www.vupen.com/english/advisories/2011/0727

http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110321_00

http://www.securityfocus.com/archive/1/517109/100/0/threaded

http://securityreason.com/securityalert/8166

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3