CVE-2022-36994: 
Veritas NetBackup Client vulnerability analysis and mitigation

An issue was discovered in Veritas NetBackup versions 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). The vulnerability (CVE-2022-36994) was disclosed in July 2022 and affects the NetBackup Primary server component. This medium severity vulnerability allows an attacker with authenticated access to a NetBackup Client to arbitrarily read files from a NetBackup Primary server (Veritas Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.3 (AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H), indicating medium severity. The attack requires network access and authenticated access to a NetBackup Client, with high attack complexity. The vulnerability allows for arbitrary file read operations against the NetBackup Primary server (Veritas Advisory).

If successfully exploited, this vulnerability allows an authenticated attacker to arbitrarily read files from a NetBackup Primary server. This could potentially lead to unauthorized access to sensitive information stored on the server (Veritas Advisory).

Veritas has released HotFixes for affected versions: NetBackup 8.1.2, 8.2, 8.3.0.1, 8.3.0.2, 9.0.0.1, and 9.1.0.1. Users are advised to apply the appropriate HotFix to Primary servers as well as all Media servers. For versions prior to 8.1.2, users should upgrade to a newer version and then apply the corresponding NetBackup HotFix (Veritas Advisory).