PT-2024-32853 · Veritas · Veritas Data Insight

Published 2024-10-03 · Updated 2025-10-17 · CVE-2024-47854

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Veritas Data Insight versions prior to 7.1

Description A security issue was discovered that allows a remote attacker to inject an arbitrary web script into an HTTP request, which could reflect back to an authenticated user without sanitization if executed by that user. This issue affects Veritas Data Insight and could potentially lead to data theft or malicious code execution.

Recommendations For versions prior to 7.1, upgrade the affected component to version 7.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the HTTP request handler to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-47854

Affected Products

Veritas Data Insight

References · 12

• 🔥 https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2024-47854 · Exploit
• https://osv.dev/vulnerability/CVE-2024-47854 · Vendor Advisory
• https://veritas.com/content/support/en_US/security/VTS24-010 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47854 · Security Note
• https://t.me/cvenotify/97007 · Telegram Post
• https://t.me/cvedetector/6964 · Telegram Post
• https://twitter.com/CVEnew/status/1842087825350754588 · Twitter Post
• https://t.me/cveNotify/139161 · Telegram Post
• https://t.me/cvenotify/97214 · Telegram Post
• https://t.me/cvenotify/101533 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1842163259152933049 · Twitter Post
• https://twitter.com/oktsec/status/1842106797173190952 · Twitter Post