CVE-2022-36956: Critical severity netbackup enterprise server vulnerability

Published Jul 27, 2022

Updated

In Veritas NetBackup, the NetBackup Client allows arbitrary command execution from any remote host that has access to a valid host-id NetBackup certificate/private key from the same domain. The affects 9.0.x through 9.0.0.1 and 9.1.x through 9.1.0.1.

Affected Software

2 affected components

Veritas NetBackup=9.0

Veritas NetBackup=9.1.0.0

Event History

Jul 27, 2022

CVE Published

via MITRE·08:57 PM

Data Sourced

via MITRE·08:57 PM

DescriptionSeverity

Frequently Asked Questions

What is the vulnerability ID for this Veritas NetBackup vulnerability?

The vulnerability ID for this Veritas NetBackup vulnerability is CVE-2022-36956.

What is the severity level of the CVE-2022-36956 vulnerability?

The severity level of the CVE-2022-36956 vulnerability is critical with a severity value of 7.5.

Which version of Veritas NetBackup is affected by CVE-2022-36956?

The versions 9.0.x through 9.0.0.1 and 9.1.x through 9.1.0.1 of Veritas NetBackup are affected by CVE-2022-36956.

How can arbitrary command execution be performed in Veritas NetBackup due to CVE-2022-36956?

Arbitrary command execution can be performed in Veritas NetBackup by any remote host that has access to a valid host-id NetBackup certificate/private key from the same domain.

Is there any fix available for CVE-2022-36956?

Please refer to the Veritas Security Advisory for information on available fixes for CVE-2022-36956.