CVE-2014-1644

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-03-29 · updated 2026-06-17
Weakness: CWE-255

Description

The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account.

Affected products

Symantec Liveupdate Administrator: through 2.3.2; 2.1.0, 2.1.2, 2.1.3, 2.2.1, 2.2.2, 2.2.2.9 (+2)

References

http://archives.neohapsis.com/archives/bugtraq/2014-03/0172.html
http://www.securityfocus.com/bid/66399
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140327_00
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140328-0_Symantec_LiveUpdate_Administrator_Multiple_vulnerabilities_wo_poc_v10.txt
http://archives.neohapsis.com/archives/bugtraq/2014-03/0172.html
http://www.securityfocus.com/bid/66399
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140327_00
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140328-0_Symantec_LiveUpdate_Administrator_Multiple_vulnerabilities_wo_poc_v10.txt

Get alerted when CVE-2014-1644 or the next vulnerability affects your stack