PT-2019-13687 · Veritas · Veritas Resiliency Platform

David Dillard · Published 2019-07-29 · Updated 2023-03-03 · CVE-2019-14418

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N

Name of the Vulnerable Software and Affected Versions Veritas Resiliency Platform versions prior to 3.4 HF1

Description An issue allows a user with sufficient privileges to overwrite any file in the virtual machine through a directory traversal vulnerability when uploading an application bundle. This could enable a malicious user to replace existing files and take control of the virtual machine.

Recommendations For versions prior to 3.4 HF1, update to version 3.4 HF1 or later to resolve the issue. As a temporary workaround, consider restricting upload privileges to trusted users until the update is applied.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-14418

Affected Products

Veritas Resiliency Platform

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-14418 · Security Note
• https://osv.dev/vulnerability/CVE-2019-14418 · Vendor Advisory
• https://veritas.com/content/support/en_US/security/VTS19-002.html#Issue1 · Vendor Advisory
• http://seclists.org/fulldisclosure/2019/Jul/39 · Note
• http://packetstormsecurity.com/files/153842/Veritas-Resiliency-Platform-VRP-Traversal-Command-Execution.html · Note