CVE-2023-37237
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
In Veritas NetBackup Appliance before version 4.1.0.1 MR3, insecure permissions may allow an authenticated Admin to bypass shell restrictions and execute arbitrary operating system commands via SSH.
Risk Assessment
The organization may be exposed to unauthorized command execution, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to upgrade to version 4.1.0.1 MR3 or later and review and adjust user permissions to minimize risk.
Other vulnerabilities in Veritas NetBackup Appliance
See all- CVE-2017-8859Critical
In Veritas NetBackup Appliance version 3.0 and earlier, unauthenticated users can execute arbitrary commands as root.
- CVE-2016-7399Critical
In Veritas NetBackup Appliance versions 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, 2.7.x through 2.7.3, and 3.0.x, a vulnerability allows remote attackers to execute arbitrary commands via shell metacharacters in the hostName parameter to appliancews/getLicense.
Original NVD description (English source)
In Veritas NetBackup Appliance before 4.1.0.1 MR3, insecure permissions may allow an authenticated Admin to bypass shell restrictions and execute arbitrary operating system commands via SSH.