CVE-2022-26484: Path Traversal
An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. The web server fails to sanitize admin/cgi-bin/rulemgr.pl/getfile/ input data, allowing a remote authenticated administrator to read arbitrary files on the system via Directory Traversal. By manipulating the resource name in GET requests referring to files with absolute paths, it is possible to access arbitrary files stored on the filesystem, including application source code, configuration files, and critical system files.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-26484?
The severity of CVE-2022-26484 is medium with a severity value of 4.9.
What is the affected software for CVE-2022-26484?
The affected software for CVE-2022-26484 is Veritas InfoScale Operations Manager versions before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100.
How can a remote authenticated administrator exploit CVE-2022-26484?
A remote authenticated administrator can exploit CVE-2022-26484 by reading arbitrary files on the system through the web server's failure to sanitize input data.
How do I fix CVE-2022-26484?
To fix CVE-2022-26484, it is recommended to upgrade to Veritas InfoScale Operations Manager 7.4.2 Patch 600 or 8.0.0 Patch 100.
Where can I find more information about CVE-2022-26484?
You can find more information about CVE-2022-26484 at the following link: [Veritas Security Advisory VTS22-002](https://www.veritas.com/content/support/en_US/security/VTS22-002)