PT-2022-26362 · Veritas · Netbackup

Published 2022-10-03 · Updated 2022-10-04 · CVE-2022-42307

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Veritas NetBackup versions through 10.0.0.1

Description An issue was discovered that makes the NetBackup Primary server vulnerable to an XML External Entity (XXE) Injection attack. This attack is possible through the DiscoveryService service.

Recommendations For versions through 10.0.0.1, consider restricting access to the DiscoveryService service as a temporary workaround until a patch is available.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2022-42307

Affected Products

Netbackup

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2022-42307 · Security Note
• https://osv.dev/vulnerability/CVE-2022-42307 · Vendor Advisory
• https://veritas.com/content/support/en_US/security/VTS22-012#M2 · Vendor Advisory