CVE-2022-36990

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related…

Critical · published July 28, 2022

CVSS v3.1
9.6
EPSS
1%
Percentile
51.8
In the wild
Unconfirmed
What it is

🚨 Remote file write access could pose a monumental risk! An authenticated attacker can write arbitrary files to any other client through the Primary server in Veritas NetBackup. 🔥 Think of it like a dinner party where a guest can sneak into the kitchen and swap out ingredients in every dish without anyone noticing—the potential for disaster is immense! An attacker could tamper with critical backups, corrupt data, or even install malicious files on other clients. This is absolutely devastating, as it could lead to significant data loss or a complete system compromise. Protecting your backups should always be top priority!

Put simply

Think of it like a dinner party where a guest can sneak into the kitchen and swap out ingredients in every dish without anyone noticing—the potential for disaster is immense! This vulnerability allows authenticated users on a NetBackup Client to write arbitrary files to any other client's filesystem via the Primary Server, potentially allowing them to overwrite important system files or backup data without restriction.

What to do

An attacker could tamper with critical backups, corrupt data, or even install malicious files on other clients. This is absolutely devastating, as it could lead to significant data loss or a complete system compromise. Protecting your backups should always be top priority! Immediately upgrade to the latest version of Veritas NetBackup to patch this vulnerability. Regularly audit user permissions to ensure only authorized personnel can access sensitive data. Implement monitoring to detect unusual access patterns on your NetBackup systems. You've got this! With these steps, you can secure your environment and protect your data. 🛡️

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AC:L/AV:N/A:H/C:N/I:H/PR:L/S:C/UI:N
CVSS v4.0
Not supplied
EPSS
0.00679 · 51.8th percentile
Published
2022-07-28T00:54Z
EPSS history
Timeline
  • 28 JUL 00:54Z
    An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related…
    cvelistv5