CVE-2022-41319: 
Veritas Desktop and Laptop Option vulnerability analysis and mitigation

A Reflected Cross-Site Scripting (XSS) vulnerability affects the Veritas Desktop Laptop Option (DLO) application login page (specifically the DLOServer/restore/login.jsp URI). The vulnerability was discovered in September 2022 and affects versions before 9.8 (versions 9.1 through 9.7). This vulnerability allows unauthenticated remote attackers to inject arbitrary web script into HTTP parameters which reflect user input without proper sanitization (Veritas Advisory).

The vulnerability is classified as a medium severity issue with a CVSS v3.1 Base Score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The vulnerability stems from Improper Neutralization of Input During Web Page Generation (CWE-79) at the endpoint https://{Host}/DLOServer/restore/login.jsp (Veritas Advisory).

If exploited, this vulnerability allows attackers to inject malicious JavaScript content that may be executed within the context of the victim's browser when they visit a specially crafted URL referencing the vulnerable login page (Veritas Advisory).

The vulnerability can be exploited by an unauthenticated remote attacker. The attack requires user interaction, as the victim must be convinced to visit a URL referencing the vulnerable page (Veritas Advisory).

Customers under a current maintenance contract should update to Desktop Laptop Option (DLO) Version 9.8, which contains fixes for this vulnerability. The update is available through the Veritas Download Center (Veritas Advisory).