CVE-2022-41320: 
Veritas System Recovery vulnerability analysis and mitigation

Veritas System Recovery (VSR) versions 18 and 21 were discovered to contain a sensitive information disclosure vulnerability (CVE-2022-41320) identified in September 2022. The vulnerability stems from the storage of network destination passwords in the Windows registry during backup configuration setup (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 (Medium severity) with the following vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The core issue involves improper storage of network destination passwords in the Windows registry during the backup configuration process (Veritas Security Advisory).

This vulnerability could allow Windows users with sufficient privileges to gain unauthorized access to network file systems that they would normally not have permission to access (NVD).

The vulnerability requires an attacker to have sufficient Windows privileges to access the registry where the password is stored. No public exploits have been reported in the wild (Veritas Security Advisory).

Veritas has released patches to address this vulnerability. For VSR 18, users should update to VSR 18 SP4 and install the updated VProSvc.exe (Version: 18.0.4.57090). For VSR 21, users should update to VSR 21 SP3 and install the updated VProSvc.exe (Version: 21.0.3.62140). The updated files need to be replaced on both servers and clients (Veritas Security Advisory).