- Description
- An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application upgrade process included unsigned files that could be exploited and result in a customer installing unauthentic components. A malicious actor could install rogue Collector executable files (aptare.jar or upgrademanager.zip) on the Portal server, which might then be downloaded and installed on collectors.
- Source
- cve@mitre.org
- NVD status
- Modified
CVSS 3.1
- Type
- Primary
- Base score
- 5.3
- Impact score
- 1.4
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Severity
- MEDIUM
- Hype score
- Not currently trending
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:veritas:aptare_it_analytics:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0740098E-CE7C-4AC6-BC8F-A51F046ABFA7",
"versionEndExcluding": "10.6.00"
},
{
"criteria": "cpe:2.3:a:veritas:netbackup_it_analytics:11.0.00:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5BD01BD6-54A5-4F81-81E2-81D65BC7428D"
},
{
"criteria": "cpe:2.3:a:veritas:netbackup_it_analytics:11.1.00:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "85A3FBC4-5341-4928-9B29-8A8A0891B9F7"
}
],
"operator": "OR"
}
]
}
]