CVE-2011-0545

Cross-site request forgery (CSRF) vulnerability in adduser.do in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts, and possibly have unspecified other impact, via the userRole parameter.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.exploit-db.com/exploits/17026	Exploit
http://sotiriu.de/adv/NSOADV-2011-001.txt	Exploit
http://www.vupen.com/english/advisories/2011/0727	Vendor Advisory
http://www.osvdb.org/71261
http://secunia.com/advisories/43820	Vendor Advisory
http://securitytracker.com/id?1025242	Exploit
http://securityreason.com/securityalert/8160
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110321_00
https://exchange.xforce.ibmcloud.com/vulnerabilities/66213
http://www.securityfocus.com/archive/1/517109/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:symantec:liveupdate_administrator:2.2.2.9:*:*:*:*:*:*:*

Information

Published : 2011-03-28 09:55

Updated : 2018-10-09 12:29

NVD link : CVE-2011-0545

Mitre link : CVE-2011-0545

JSON object : View

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

Advertisement

Products Affected

symantec

liveupdate_administrator

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.exploit-db.com/exploits/17026", "name": "17026", "tags": ["Exploit"], "refsource": "EXPLOIT-DB"}, {"url": "http://sotiriu.de/adv/NSOADV-2011-001.txt", "name": "http://sotiriu.de/adv/NSOADV-2011-001.txt", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://www.vupen.com/english/advisories/2011/0727", "name": "ADV-2011-0727", "tags": ["Vendor Advisory"], "refsource": "VUPEN"}, {"url": "http://www.osvdb.org/71261", "name": "71261", "tags": [], "refsource": "OSVDB"}, {"url": "http://secunia.com/advisories/43820", "name": "43820", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://securitytracker.com/id?1025242", "name": "1025242", "tags": ["Exploit"], "refsource": "SECTRACK"}, {"url": "http://securityreason.com/securityalert/8160", "name": "8160", "tags": [], "refsource": "SREASON"}, {"url": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110321_00", "name": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110321_00", "tags": [], "refsource": "CONFIRM"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66213", "name": "symantec-lua-gui-csrf(66213)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/517109/100/0/threaded", "name": "20110322 NSOADV-2011-001: Symantec LiveUpdate Administrator CSRF vulnerability", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in adduser.do in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts, and possibly have unspecified other impact, via the userRole parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-352"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2011-0545", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2011-03-28T16:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:symantec:liveupdate_administrator:2.2.2.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-09T19:29Z"}