Vulnerability CVE-2011-0545
Published: 2011-03-28   Modified: 2012-02-13

Description:
Cross-site request forgery (CSRF) vulnerability in adduser.do in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts, and possibly have unspecified other impact, via the userRole parameter.

See advisories in our WLB2 database:
Topic
Author
Date
Low
Symantec LiveUpdate Administrator Management GUI HTML Injection
Nikolas Sotiriu
28.03.2011

Type:

CWE-352

 (Cross-Site Request Forgery (CSRF))

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
6.4/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Symantec -> Liveupdate administrator 

 References:
http://securityreason.com/securityalert/8160
http://securitytracker.com/id?1025242
http://sotiriu.de/adv/NSOADV-2011-001.txt
http://www.exploit-db.com/exploits/17026
http://www.securityfocus.com/archive/1/517109/100/0/threaded
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110321_00
http://www.vupen.com/english/advisories/2011/0727
https://exchange.xforce.ibmcloud.com/vulnerabilities/66213
Copyright 2024, cxsecurity.com

 

Back to Top