CVE-2013-6223
low
CVSS v3
—
CVSS v2
2.1
VIR risk
2.1
Description
LiveZilla before 5.1.1.0 stores the admin Base64 encoded username and password in a 1click file, which allows local users to obtain access by reading the file.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cve@mitre.org — http://forums.livezilla.net/index.php?/topic/163-livezilla-changelog/
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| livezilla | livezilla | {"endIncluding":"5.1.0.0"} | |
| livezilla | livezilla | 3.1.8.3 | |
| livezilla | livezilla | 3.2.0.2 | |
| livezilla | livezilla | 4.0.1.0 | |
| livezilla | livezilla | 4.0.1.1 | |
| livezilla | livezilla | 4.0.1.2 | |
| livezilla | livezilla | 4.1.0.3 | |
| livezilla | livezilla | 4.1.0.4 | |
| livezilla | livezilla | 4.2.0.4 | |
| livezilla | livezilla | 4.2.0.5 | |
| livezilla | livezilla | 5.0.1.0 | |
| livezilla | livezilla | 5.0.1.1 | |
| livezilla | livezilla | 5.0.1.2 | |
| livezilla | livezilla | 5.0.1.3 | |
| livezilla | livezilla | 5.0.1.4 | |
References
- http://blog.curesec.com/article/blog/27.html
- http://forums.livezilla.net/index.php?/topic/163-livezilla-changelog/
- http://osvdb.org/100400
- http://seclists.org/fulldisclosure/2013/Nov/210
- http://blog.curesec.com/article/blog/27.html
- http://forums.livezilla.net/index.php?/topic/163-livezilla-changelog/
- http://osvdb.org/100400
- http://seclists.org/fulldisclosure/2013/Nov/210
CWEs
CWE-255
Verify integrity in audit chain (admin only). AS-IS.