Medium severity · published Apr 5, 2023
CVE-2023-26789
Veritas NetBackUp OpsCenter Version 9.1.0.1 is vulnerable to Reflected Cross-site scripting (XSS)
6.1
CVSS
0.5%
EPSS
No
On KEV
Description
Veritas NetBackUp OpsCenter Version 9.1.0.1 is vulnerable to Reflected Cross-site scripting (XSS). The Web App fails to adequately sanitize special characters. By leveraging this issue, an attacker is able to cause arbitrary HTML and JavaScript code to be executed in a user's browser.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
Netbackup Opscenter · Veritas
9.1.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-26789
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-26789
Third Party Advisory
https://github.com/IthacaLabs/Veritas-Technologies
Broken Link
https://github.com/IthacaLabs/Veritas-Technologies/blob/main/Veritas%20NetBackUp%20OpsCenter%20Version%209.1.0.1/Reflected%20XSS/XSS.txt
Third Party Advisory
https://github.com/IthacaLabs/Veritas-Technologies/blob/main/Veritas%20NetBackUp%20OpsCenter%20Version%209.1.0.1/Reflected%20XSS/XSS_CVE-2023-26789.txt