CVE-2022-26483

An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. A reflected cross-site scripting (XSS) vulnerability in admin/cgi-bin/listdir.pl allows authenticated remote administrators to inject arbitrary web script or HTML into an HTTP GET parameter (which reflect the user input without sanitization).

CVSS v3 4.8 MEDIUM
CVSS v2.0 3.5 LOW

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://www.veritas.com/content/support/en_US/security/VTS22-002	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:veritas:infoscale_operations_manager::::::::
	cpe:2.3:a:veritas:infoscale_operations_manager:8.0.0:::::::*

History

No history.

Information

Published : 2022-03-04 19:15

Updated : 2024-02-28 19:09

NVD link : CVE-2022-26483

Mitre link : CVE-2022-26483

CVE.ORG link : CVE-2022-26483

JSON object : View

Products Affected

veritas

infoscale_operations_manager

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2022-26483", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}, {"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2022-03-04T19:15:09.050", "references": [{"url": "https://www.veritas.com/content/support/en_US/security/VTS22-002", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. A reflected cross-site scripting (XSS) vulnerability in admin/cgi-bin/listdir.pl allows authenticated remote administrators to inject arbitrary web script or HTML into an HTTP GET parameter (which reflect the user input without sanitization)."}, {"lang": "es", "value": "Se ha detectado un problema en Veritas InfoScale Operations Manager (VIOM) versiones anteriores a 7.4.2 Parche 600 y 8.x versiones anteriores a 8.0.0 Parche 100. Una vulnerabilidad de tipo cross-site scripting (XSS) reflejado en el archivo admin/cgi-bin/listdir.pl permite a los administradores remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios en un par\u00e1metro GET de HTTP (que refleja la entrada del usuario sin saneo)"}], "lastModified": "2022-03-12T01:51:45.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:veritas:infoscale_operations_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DDF0DD38-26D9-4850-9A6C-6DA382DB4C6F", "versionEndExcluding": "7.4.2.600"}, {"criteria": "cpe:2.3:a:veritas:infoscale_operations_manager:8.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18AF1421-EE91-4ADF-9788-4DF3B7C97D2F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}