{"id":"CVE-2023-32568","aliases":["EUVD-2023-36812","GHSA-9vmr-frgp-5398"],"status":"published","title":"An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x...","description":"An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The VIOM web application does not validate user-supplied data and appends it to OS commands and internal binaries used by the application. An attacker with root/administrator level privileges can leverage this to read sensitive data stored on the servers, modify data or server configuration, and delete data or application configuration.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:U/UI:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00701,"percentile":0.53546,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2023-05-10T00:00:00Z","modified":"2026-06-17T05:59:08Z","products":[{"vendor":"veritas","product":"infoscale_operations_manager"}],"references":[{"url":"https://www.veritas.com/content/support/en_US/security/VTS23-007","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32568"},{"url":"https://github.com/advisories/GHSA-9vmr-frgp-5398"}],"sources":{"cve":[{"id":"CVE-2023-32568","description":"An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The VIOM web application does not validate user-supplied data and appends it to OS commands and internal binaries used by the application. An attacker with root/administrator level privileges can leverage this to read sensitive data stored on the servers, modify data or server configuration, and delete data or application configuration.","status":"published","published":"2023-05-10T00:00:00Z","modified":"2025-01-28T15:54:14.856Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:U/UI:N","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:29.381004Z"}],"euvd":[{"id":"EUVD-2023-36812","description":"An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The VIOM web application does not validate user-supplied data and appends it to OS commands and internal binaries used by the application. An attacker with root/administrator level privileges can leverage this to read sensitive data stored on the servers, modify data or server configuration, and delete data or application configuration.","status":"published","published":"2023-05-10T00:00:00Z","modified":"2025-01-28T15:54:14Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:U/UI:N","level":"high"}],"updated_at":"2026-11-03T00:04:11.814906Z"}],"ghsa":[{"id":"GHSA-9vmr-frgp-5398","title":"An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x...","description":"An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The VIOM web application does not validate user-supplied data and appends it to OS commands and internal binaries used by the application. An attacker with root/administrator level privileges can leverage this to read sensitive data stored on the servers, modify data or server configuration, and delete data or application configuration.","status":"published","published":"2023-05-10T06:30:27Z","modified":"2024-04-04T03:58:18Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:56:20.113325Z"}],"nvd":[{"id":"CVE-2023-32568","description":"An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The VIOM web application does not validate user-supplied data and appends it to OS commands and internal binaries used by the application. An attacker with root/administrator level privileges can leverage this to read sensitive data stored on the servers, modify data or server configuration, and delete data or application configuration.","status":"published","published":"2023-05-10T05:15:11.99Z","modified":"2026-06-17T05:59:08.273Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:08:01.131774Z"}]}}