PT-2022-25814 · Veritas · Veritas System Recovery

Published 2022-09-23 · Updated 2022-09-26 · CVE-2022-41320

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Veritas System Recovery (VSR) versions 18 and 21

Description The issue allows a Windows user with sufficient privileges to access a network file system they were not authorized to access. This is due to the storage of a network destination password in the Windows registry during the configuration of the backup configuration.

Recommendations For versions 18 and 21, consider restricting access to the Windows registry to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the privileges of Windows users to prevent unauthorized access to network file systems.

Fix

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

CVE-2022-41320

Affected Products

Veritas System Recovery

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-41320 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41320 · Vendor Advisory
• https://veritas.com/content/support/en_US/security/VTS21-002 · Vendor Advisory
• https://t.me/cvenotify/36740 · Telegram Post
• https://t.me/cibsecurity/50310 · Telegram Post