PT-2022-17895 · Veritas · Veritas Infoscale Operations Manager

Published 2022-03-04 · Updated 2022-03-12 · CVE-2022-26483

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AC:L/AV:N/A:N/C:L/I:L/PR:H/S:C/UI:R

Name of the Vulnerable Software and Affected Versions Veritas InfoScale Operations Manager versions prior to 7.4.2 Patch 600 Veritas InfoScale Operations Manager versions 8.x prior to 8.0.0 Patch 100

Description A reflected cross-site scripting (XSS) issue allows authenticated remote administrators to inject arbitrary web script or HTML into an HTTP GET parameter, which reflects user input without sanitization. This occurs in the listdir.pl file within the admin/cgi-bin directory.

Recommendations For versions prior to 7.4.2 Patch 600, update to 7.4.2 Patch 600 or later. For versions 8.x prior to 8.0.0 Patch 100, update to 8.0.0 Patch 100 or later. As a temporary workaround, consider restricting access to the admin/cgi-bin/listdir.pl endpoint until a patch is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-26483

Affected Products

Veritas Infoscale Operations Manager

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-26483 · Security Note
• https://osv.dev/vulnerability/CVE-2022-26483 · Vendor Advisory
• https://veritas.com/content/support/en_US/security/VTS22-002 · Vendor Advisory
• https://t.me/cibsecurity/38465 · Telegram Post