High severity · published Dec 4, 2022
CVE-2022-46413
An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100
8.8
CVSS
2.8%
EPSS
No
On KEV
Description
An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. Authenticated remote command execution can occur via the management portal.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Access Appliance · Veritas
through 8.0.100 · source: NVD
NF
Netbackup Flex Scale Appliance · Veritas
through 3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-46413
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-46413
Vendor Advisory
https://www.veritas.com/content/support/en_US/security/VTS22-019#issue2
More from Access Appliance
9.8
CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
9.8
CVE-2022-46414
An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100
9.8
CVE-2019-18780
An arbitrary command injection vulnerability in the Cluster Server component of Veritas InfoScale allows an unauthenticated remote attacker to execute arbitrary commands as root…
8.8
CVE-2022-46411
An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100