PT-2019-13684 · Veritas · Veritas Resiliency Platform

Published 2019-07-29 · Updated 2023-03-03 · CVE-2019-14415

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AC:L/AV:N/A:L/C:L/I:L/PR:H/S:C/UI:R

Name of the Vulnerable Software and Affected Versions Veritas Resiliency Platform versions prior to 3.4 HF1

Description A persistent cross-site scripting issue allows a malicious user to inject malicious script into another user's browser, related to resiliency plans functionality. This occurs when a victim opens a resiliency plan that an attacker has access to.

Recommendations For versions prior to 3.4 HF1, update to version 3.4 HF1 or later to resolve the issue. As a temporary workaround, consider restricting access to resiliency plans to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-14415

Affected Products

Veritas Resiliency Platform

References · 5

• https://osv.dev/vulnerability/CVE-2019-14415 · Vendor Advisory
• https://veritas.com/content/support/en_US/security/VTS19-002.html#Issue4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14415 · Security Note
• http://seclists.org/fulldisclosure/2019/Jul/39 · Note
• http://packetstormsecurity.com/files/153842/Veritas-Resiliency-Platform-VRP-Traversal-Command-Execution.html · Note