Cross-Site Scripting Vulnerability in Symantec LiveUpdate Administrator

CVE-2011-1524

Summary

A cross-site scripting (XSS) vulnerability exists in the management login GUI page of Symantec LiveUpdate Administrator prior to version 2.3. This flaw allows remote attackers to inject arbitrary web scripts or HTML code via the username field. Exploitation of this vulnerability could enable an attacker to manipulate user actions by embedding malicious content, thereby compromising user data or session integrity. An example of exploitation includes injecting an IFRAME element into the event log, posing additional security risks distinct from related vulnerabilities.

References