PT-2022-11430 · Veritas · Veritas Netbackup Opscenter Analytics

Published 2022-04-19 · Updated 2022-04-27 · CVE-2021-41570

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Veritas NetBackup OpsCenter Analytics version 9.1

Description The issue allows for XSS via the NetBackup Master Server Name, Display Name, NetBackup User Name, or NetBackup Password field during a Settings/Configuration Add operation.

Recommendations For Veritas NetBackup OpsCenter Analytics version 9.1, consider restricting access to the vulnerable fields until a patch is available. As a temporary workaround, avoid using the NetBackup Master Server Name, Display Name, NetBackup User Name, or NetBackup Password fields in the Settings/Configuration Add operation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-41570

Affected Products

Veritas Netbackup Opscenter Analytics

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-41570 · Security Note
• https://veritas.com/support/en_US/security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41570 · Vendor Advisory
• https://veritas.com/content/support/en_US/security/VTS22-007 · Vendor Advisory
• https://t.me/cvenotify/29150 · Telegram Post
• https://t.me/cibsecurity/41092 · Telegram Post