CVE-2022-36949

In Veritas NetBackup OpsCenter, an attacker with local access to a NetBackup OpsCenter server could potentially escalate their privileges

Critical · published July 27, 2022

CVSS v3.1
9.3
EPSS
0%
Percentile
8.5
In the wild
Unconfirmed
What it is

🔥 An attacker with local access can escalate privileges in Veritas NetBackup OpsCenter — like finding a hidden staircase in a secure building that leads straight to the executive suite! 🚀 Imagine you’re in a hotel where a janitor discovers a door that leads directly to the penthouse; with a little knowledge, they can waltz in and access everything. This vulnerability allows local attackers to climb the ladder of privilege without detection! This could be absolutely devastating! An attacker could gain unauthorized access to sensitive data and critical functions, potentially wreaking havoc on your backup operations. If left unaddressed, it could lead to severe data breaches or system manipulations, putting your entire infrastructure at risk.

Put simply

Imagine you’re in a hotel where a janitor discovers a door that leads directly to the penthouse; with a little knowledge, they can waltz in and access everything. This vulnerability allows local attackers to climb the ladder of privilege without detection! In Veritas NetBackup OpsCenter, local users can exploit this privilege escalation vulnerability to gain higher-level access, bypassing standard security measures. This affects versions 8.x, 9.x, and 10.x, leaving systems exposed if running these configurations.

What to do

This could be absolutely devastating! An attacker could gain unauthorized access to sensitive data and critical functions, potentially wreaking havoc on your backup operations. If left unaddressed, it could lead to severe data breaches or system manipulations, putting your entire infrastructure at risk. Immediately patch to version 8.3.0.3 or later, and 9.1.0.2 to mitigate this issue. Review user access privileges to ensure no unauthorized users have local access. Regular audits will further protect your systems from potential threats! You've got this! Follow these steps, and you'll regain your security hero status in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:C/UI:N
CVSS v4.0
Not supplied
EPSS
0.00193 · 8.5th percentile
Published
2022-07-27T21:00Z
EPSS history
Timeline
  • 27 JUL 21:00Z
    In Veritas NetBackup OpsCenter, an attacker with local access to a NetBackup OpsCenter server could potentially escalate their privileges
    cvelistv5