Vulnerability in Symantec Liveupdate Administrator

CVE-2014-1644

The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account.

EPSS: 0.026 (84.0th percentile) — read the EPSS interpretation.

Affected products

Symantec Liveupdate_administrator — versions 2.1.0, 2.1.2, 2.1.3
N/a — versions n/a

Weakness classification (CWE)

CWE-255

References

secure@symantec.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
secure@symantec.com (mailing-list, x_refsource_BUGTRAQ)
secure@symantec.com (vdb-entry, x_refsource_BID)
secure@symantec.com (x_refsource_MISC)