Medium severity · published Apr 10, 2023
CVE-2023-26788
Veritas Appliance v4.1.0.1 is affected by Host Header Injection attacks
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
Veritas Appliance v4.1.0.1 is affected by Host Header Injection attacks. HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would just cause the request to be sent to a completely different Domain/IP address.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
Netbackup Appliance Firmware · Veritas
4.1.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-26788
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-26788
Vendor Advisory
https://github.com/IthacaLabs/Veritas-Technologies
Exploit
https://github.com/IthacaLabs/Veritas-Technologies/blob/main/Veritas%20Appliance%20v4.1.0.1/HHI/HHI_CVE-2023-26788.txt
More from Netbackup Appliance Firmware
9.8
CVE-2016-7399
scripts/license.pl in Veritas NetBackup Appliance 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, 2.7.x through 2.7.3, and 3.0.x allow remote attackers to execute arbitrary…