Lucene search

MitreCVE-2023-38404

HistoryJul 17, 2023 - 9:15 p.m.

CVE-2023-38404

2023-07-1721:15:09

CWE-434

mitre

web.nvd.nist.gov

cve-2023-38404

veritas infoscale

xprtld

viom

web application

file upload

command execution

security vulnerability

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

41.1%

JSON

The XPRTLD web application in Veritas InfoScale Operations Manager (VIOM) before 8.0.0.410 allows an authenticated attacker to upload all types of files to the server. An authenticated attacker can then execute the malicious file to perform command execution on the remote server.

Affected configurations

Nvd

Node

veritasinfoscale_operations_managerRange7.0.0–8.0.0.410

VendorProductVersionCPE
veritasinfoscale_operations_manager*cpe:2.3:a:veritas:infoscale_operations_manager:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
veritas	infoscale_operations_manager	*	cpe:2.3:a:veritas:infoscale_operations_manager::::::::

References

www.veritas.com/content/support/en_US/security/VTS23-009

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

41.1%

JSON

Related for CVE-2023-38404