CVE-2023-28818: veritas aptare_it_analytics
Vulnerability summary
CVE-2023-28818 is a medium (CVSS 5.3) vulnerability in veritas aptare_it_analytics. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.7% of scored vulnerabilities.
Timeline
- 24-03-2023PublishedVulnerability first disclosed.
- 19-02-2025Last modifiedVulnerability information updated.
Description
An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application upgrade process included unsigned files that could be exploited and result in a customer installing unauthentic components. A malicious actor could install rogue Collector executable files (aptare.jar or upgrademanager.zip) on the Portal server, which might then be downloaded and installed on collectors.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.17%
Chance of exploitation in the next 30 days
Percentile
6%
Versus all other CVEs
30-day change
0.00 pp
From 0.17% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-347Improper Verification of Cryptographic SignatureThe product does not verify, or incorrectly verifies, the cryptographic signature for data.
- CWE-494Download of Code Without Integrity CheckThe product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
Affected systems
Veritas2 products
- aptare_it_analytics< 10.6.00
- netbackup_it_analytics11.0.00 | 11.1.00
1 vendor · 2 products
References
1 links- www.veritas.com/content/support/en_US/security/VTS23-002Vendor Advisory