SQL Injection in Symantec Liveupdate Administrator
CVE-2014-1645
SQL injection vulnerability in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Vulnerability class: SQL Injection
EPSS: 0.014 (69.9th percentile) — read the EPSS interpretation.
Affected products
- Symantec Liveupdate_administrator — versions 2.1.0, 2.1.2, 2.1.3
- N/a — versions n/a
Weakness classification (CWE)
References
- secure@symantec.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
- secure@symantec.com (mailing-list, x_refsource_BUGTRAQ)
- secure@symantec.com (vdb-entry, x_refsource_BID)
- secure@symantec.com (x_refsource_MISC)