CVE-2022-37000: 
Veritas NetBackup Client vulnerability analysis and mitigation

A medium severity vulnerability (CVE-2022-37000) was discovered in Veritas NetBackup versions 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1, along with related NetBackup products. The vulnerability was disclosed on July 28, 2022, and affects the NetBackup Primary server component (Veritas Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), indicating medium severity. The vulnerability requires network access and low privileges but no user interaction. The attack vector is network-based, with low attack complexity and requires low privileges (Veritas Advisory).

If exploited, this vulnerability allows an attacker with authenticated access to a NetBackup Client to remotely read files on a NetBackup Primary server under certain conditions. The impact is limited to confidentiality with no effect on integrity or availability (Veritas Advisory).

Veritas has released HotFixes for affected versions including NetBackup 8.1.2, 8.2, 8.3.0.1, 8.3.0.2, 9.0.0.1, and 9.1.0.1. Users are advised to apply the appropriate HotFix to Primary servers. For versions prior to 8.1.2, users should upgrade to a newer version and then apply the applicable NetBackup HotFix (Veritas Advisory).