CVE-2023-28818

Published Mar 24, 2023

Last updated 2 years ago

Overview

Description: An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application upgrade process included unsigned files that could be exploited and result in a customer installing unauthentic components. A malicious actor could install rogue Collector executable files (aptare.jar or upgrademanager.zip) on the Portal server, which might then be downloaded and installed on collectors.
Source: cve@mitre.org
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.3
Impact score: 1.4
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-347

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:veritas:aptare_it_analytics:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0740098E-CE7C-4AC6-BC8F-A51F046ABFA7",
            "versionEndExcluding": "10.6.00"
          },
          {
            "criteria": "cpe:2.3:a:veritas:netbackup_it_analytics:11.0.00:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5BD01BD6-54A5-4F81-81E2-81D65BC7428D"
          },
          {
            "criteria": "cpe:2.3:a:veritas:netbackup_it_analytics:11.1.00:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "85A3FBC4-5341-4928-9B29-8A8A0891B9F7"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

Weaknesses

Configurations

References