CVE-2014-1644
The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate...
The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account.
Exploit likelihood
What each source reports
NVD Score used
The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account.
- Record
CVE-2014-1644- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-255
- Updated
- 2026-11-02
CVE List No score
The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account.
- Record
CVE-2014-1644- Updated
- 2026-11-02
EUVDEUVD-2014-1718 No score
The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account.
- Record
EUVD-2014-1718- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h5j2-74f6-pf8w No score
The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate...
The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account.
- Record
GHSA-h5j2-74f6-pf8w- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-1644 is a high vulnerability (CVSS 7.5) in Symantec Liveupdate Administrator, published March 29, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.69%, the 85th percentile. No source names a fixed version.
References
symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140327_00
archives.neohapsis.com/archives/bugtraq/2014-03/0172.html
securityfocus.com/bid/66399
sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140328-0_Symantec_LiveUpdate_Administrator_Multiple_vulnerabilities_wo_poc_v10.txt
nvd.nist.gov/vuln/detail/CVE-2014-1644
github.com/advisories/GHSA-h5j2-74f6-pf8w