VulnerabilityModified

CVE-2023-32569

The InfoScale VIOM web application is vulnerable to SQL Injection in some of the areas of the application.

CRITICAL 9.8EPSS 0.58%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.58%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The InfoScale VIOM web application is vulnerable to SQL Injection in some of the areas of the application. This allows attackers (who must have admin credentials) to submit arbitrary SQL commands on the back-end database to create, read, update, or delete any sensitive data stored in the database.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.58% probability · 46th percentile
CISA KEV: Not listed
Weakness: CWE-89
Affected: veritas/infoscale operations manager
Source: cve@mitre.org

References

https://www.veritas.com/content/support/en_US/security/VTS23-007Vendor Advisory
https://www.veritas.com/content/support/en_US/security/VTS23-007Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.