Netbackup Administration Console Web Interface
Monthly
Reflected cross-site scripting (CWE-80) in the Cohesity NetBackup Administration Console web interface before version 11.2 allows remote attackers to inject malicious script into a victim's browser session via a crafted URL, potentially leading to session hijacking or theft of sensitive information in the context of the console. The vulnerability requires user interaction (the victim must be logged into the console and open the malicious link), and no public exploit code or active exploitation has been identified at time of analysis. Cohesity has released a fix in NetBackup 11.2.
Reflected cross-site scripting (CWE-80) in the Cohesity NetBackup Administration Console web interface before version 11.2 allows remote attackers to inject malicious script into a victim's browser session via a crafted URL, potentially leading to session hijacking or theft of sensitive information in the context of the console. The vulnerability requires user interaction (the victim must be logged into the console and open the malicious link), and no public exploit code or active exploitation has been identified at time of analysis. Cohesity has released a fix in NetBackup 11.2.