CVE-2022-42307

An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) Injection attack through the DiscoveryService service.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.veritas.com/content/support/en_US/security/VTS22-012#M2	Patch Vendor Advisory
https://www.veritas.com/content/support/en_US/security/VTS22-012#M2	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:veritas:netbackup:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:24

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~9.8~~	v2 : unknown v3 : 5.3
References	~~() https://www.veritas.com/content/support/en_US/security/VTS22-012#M2 - Patch, Vendor Advisory~~	() https://www.veritas.com/content/support/en_US/security/VTS22-012#M2 - Patch, Vendor Advisory

Information

Published : 2022-10-03 15:15

Updated : 2024-11-21 07:24

NVD link : CVE-2022-42307

Mitre link : CVE-2022-42307

CVE.ORG link : CVE-2022-42307

JSON object : View

Products Affected

veritas

netbackup

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2022-42307", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-10-03T15:15:22.343", "references": [{"url": "https://www.veritas.com/content/support/en_US/security/VTS22-012#M2", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.veritas.com/content/support/en_US/security/VTS22-012#M2", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) Injection attack through the DiscoveryService service."}, {"lang": "es", "value": "Se ha detectado un problema en Veritas NetBackup versiones hasta 10.0.0.1 y en los productos de Veritas relacionados. El servidor NetBackup Primary es vulnerable a un ataque de tipo XML External Entity (XXE) por medio del servicio DiscoveryService"}], "lastModified": "2024-11-21T07:24:42.790", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:veritas:netbackup:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69934CDE-4DC7-4E6F-8FE1-2D4FACA7F7B5", "versionEndIncluding": "10.0.0.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}