VIR Vulnerability Intelligence Relay

CVE-2013-7385

medium
Published 2014-05-19 · Modified 2026-05-06
CVSS v3
—
CVSS v2
6.8
VIR risk
6.8

Description

LiveZilla 5.1.2.1 and earlier includes the MD5 hash of the operator password in plaintext in Javascript code that is generated by lz/mobile/chat.php, which allows remote attackers to obtain sensitive information and gain privileges by accessing the loginName and loginPassword variables using an independent cross-site scripting (XSS) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7033.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

Application impact
VendorProductVersionsFixed
livezillalivezilla{"endIncluding":"5.1.2.1"}
livezillalivezilla5.0.1.0
livezillalivezilla5.0.1.1
livezillalivezilla5.0.1.2
livezillalivezilla5.0.1.3
livezillalivezilla5.0.1.4
livezillalivezilla5.1.0.0
livezillalivezilla5.1.1.0
livezillalivezilla5.1.2.0

References

CWEs

CWE-310

Verify integrity in audit chain (admin only). AS-IS.