CVE-2022-36987: 
Veritas NetBackup Client vulnerability analysis and mitigation

An issue was discovered in Veritas NetBackup versions 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1. The vulnerability (CVE-2022-36987) was disclosed on July 28, 2022, and affects NetBackup Primary server systems (AttackerKB).

The vulnerability allows an attacker with authenticated access to a NetBackup Client to arbitrarily write files to a NetBackup Primary server. The vulnerability has been assigned a CVSS v3.1 Base Score of 8.5 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating high severity (Veritas Advisory).

If successfully exploited, this vulnerability could allow an authenticated attacker to write arbitrary files to the NetBackup Primary server, potentially leading to system compromise through arbitrary file writes (Veritas Advisory).

Veritas has released HotFixes for affected versions including NetBackup 8.1.2, 8.2, 8.3.0.1, 8.3.0.2, 9.0.0.1, and 9.1.0.1. Users are advised to apply the appropriate HotFix to Primary servers. For versions prior to 8.1.2, users should upgrade to a newer version and apply the corresponding NetBackup HotFix (Veritas Advisory).