VulnerabilityModified

CVE-2023-28818

A malicious actor could install rogue Collector executable files (aptare.jar or upgrademanager.zip) on the Portal server, which might then be downloaded and installed on collectors.

MEDIUM 5.3EPSS 0.17%

Does this matter?

Lower severity and a low EPSS score (0.17%). Track it; it rarely justifies an emergency change on its own.

Description

An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application upgrade process included unsigned files that could be exploited and result in a customer installing unauthentic components. A malicious actor could install rogue Collector executable files (aptare.jar or upgrademanager.zip) on the Portal server, which might then be downloaded and installed on collectors.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS: 0.17% probability · 6th percentile
CISA KEV: Not listed
Weakness: CWE-347, CWE-494
Affected: veritas/aptare it analytics · veritas/netbackup it analytics
Source: cve@mitre.org

References

https://www.veritas.com/content/support/en_US/security/VTS23-002Vendor Advisory
https://www.veritas.com/content/support/en_US/security/VTS23-002Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.