Veritas Enterprise Vault XSS Vulnerability Advisory (CVE-2024-52941 to 52944)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability ID: VTS24-013 2. Vulnerability Name: Cross-Site Scripting Vulnerabilities in Veritas Enterprise Vault 3. Revision History: - 1.0: November 12, 2024: Initial version - 2.0: November 19, 2024: CVE IDs added 4. Vulnerability Description: - A vulnerability has been discovered in Veritas Enterprise Vault versions 15.1 and earlier. - This vulnerability allows an authenticated remote attacker to inject parameters while viewing archived content, enabling cross-site scripting (XSS) attacks. - Such attacks can be traced back to the authenticated user if executed by that user. 5. Vulnerability Severity: Medium 6. CVE IDs: - CVE-2024-52941 - CVE-2024-52942 - CVE-2024-52943 - CVE-2024-52944 7. Affected Versions: - All currently supported Enterprise Vault versions: 15.1, 15.0, 15.0.1, 15.0.2, 14.5, 14.5.1, 14.4, 14.4.1, 14.4.2, 14.3, 14.3.1, 14.3.2, 14.2, 14.2.3, 14.2.2, 14.2.1, 14.1.3, 14.1.2, 14.1.1, 14.1, 14.0.1, 14.0. - Earlier unsupported versions may also be affected. 8. Remediation: - Obtain security patches for versions 14.5.2, 15.0, and 15.1 via the provided link. - Review detailed installation steps in the Readme file and ensure these patches are applied to all Enterprise Vault servers in the environment. - Customers running older versions should plan appropriate upgrades. 9. Questions and Support: - For any questions or issues related to these vulnerabilities, contact Veritas Technical Support. 10. Acknowledgments: - Veritas thanks Sina Kheirkhah, in collaboration with Trend Micro’s Zero Day Initiative (ZDI), for reporting these vulnerabilities. 11. Disclaimer: - This security advisory is provided “AS IS” without any express or implied warranties, including but not limited to any implied warranties of merchantability, fitness for a particular purpose, or non-infringement, unless such disclaimers are legally invalid. - Veritas Technologies LLC is not liable for any incidental or consequential damages arising from the provision, performance, or use of this document. - Information in this document may be changed at any time without notice. This information provides a detailed description of the cross-site scripting vulnerabilities discovered in Veritas Enterprise Vault, along with remediation guidance.

Goal Reached Thanks to every supporter — we hit 100%!

Veritas Enterprise Vault XSS Vulnerability Advisory (CVE-2024-52941 to 52944)