PT-2022-6068 · Veritas · Veritas Netbackup+1

Published 2022-11-15 · Updated 2025-04-29 · CVE-2022-45461

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Veritas NetBackup versions through 10.1 Veritas NetBackup Appliance versions (affected versions not specified) Related Veritas products on Linux and UNIX versions (affected versions not specified)

Description The Java Admin Console in Veritas NetBackup allows authenticated non-root users, who have been explicitly added to the auth.conf file, to execute arbitrary commands as root. This issue is related to the failure to neutralize special elements used in operating system commands. Exploitation of this issue may allow a remote attacker to execute arbitrary commands as the root user.

Recommendations For Veritas NetBackup versions through 10.1, consider disabling the Java Admin Console until a patch is available. For Veritas NetBackup Appliance and related Veritas products on Linux and UNIX, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

OS Command Injection

Weakness Enumeration

CWE-269

CWE-264

CWE-78

Related Identifiers

BDU:2023-00002

CVE-2022-45461

Affected Products

Veritas Netbackup

Veritas Netbackup Appliance

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-45461 · Security Note
• https://veritas.com/content/support/en_US/security/VTS22-015 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-45461 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00002 · Security Note
• https://t.me/cvenotify/37942 · Telegram Post
• https://t.me/pentestingnews/30375 · Telegram Post
• https://t.me/cibsecurity/53058 · Telegram Post
• https://t.me/cvenotify/120165 · Telegram Post