CVE-2020-36159: 
Veritas Desktop and Laptop Option vulnerability analysis and mitigation

Veritas Desktop and Laptop Option (DLO) before version 9.5 contained an information disclosure vulnerability (CVE-2020-36159) that was discovered and disclosed on January 5, 2021. The vulnerability affected the backup processing status functionality of the DLO application (Vendor Advisory).

The vulnerability allowed unauthorized access to operational information about backup processing status through a URL endpoint that lacked proper authentication controls. The issue received a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating it was network accessible, required low attack complexity, and could result in unauthorized information disclosure (NVD).

The vulnerability exposed operational information related to backup processing status to unauthorized users. While the confidentiality impact was rated as Low, the vulnerability did not affect system integrity or availability (Vendor Advisory).

The vulnerability could be exploited remotely without requiring authentication or user interaction. The attack complexity was rated as Low, indicating relatively straightforward exploitation (NVD).

Veritas addressed this vulnerability in DLO version 9.5. The vendor recommended that all customers upgrade to this version to resolve the security issue (Vendor Advisory).