CVE-2011-0545: Cross-site request forgery (CSRF) vulnerability in adduser.do in Symantec LiveUpdate Administrator (LUA) be...

Security readout for executives and security teams

An attacker could trick a logged-in Symantec LiveUpdate Administrator administrator into unknowingly sending a request that creates a new administrative account. The issue affects LUA versions before 2.3. This matters mainly where legacy Symantec update infrastructure remains in use. Exposure is likely limited to organizations still running Symantec LiveUpdate Administrator before 2.3, especially if administrators access the web interface from browsers that can reach untrusted content. Prioritize remediation if LUA before 2.3 remains deployed. The business risk is unauthorized administrative access to update management infrastructure, but urgency depends on whether the legacy product is still present and reachable. Mitigation focus: Upgrade Symantec LiveUpdate Administrator to version 2.3 or later, per the affected version boundary.; Review Symantec's 2011 security advisory for exact vendor guidance and supported upgrade paths.; Restrict LUA administrator interface access to trusted management networks..

Prepared

Jun 24, 2026, 13:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.