CVE-2014-1644

CWE-2553 documents3 sources
Severity
7.5HIGH
EPSS
0.9%
top 24.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Symantec Liveupdate Administrator
Timeline
PublishedMar 29
Latest updateMay 17

Description

The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages1 packages

Patches

Patch: www.symantec.com ↗Patch: www.symantec.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-h5j2-74f6-pf8w: The forgotten-password feature in forcepasswd↗2022-05-17
▶
CVEList
CVE-2014-1644: The forgotten-password feature in forcepasswd↗2014-03-29
▶