CVE-2019-14418

high-risk

Published 2019-07-29

An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. When uploading an application bundle, a directory traversal vulnerability allows a VRP user with sufficient privileges to overwrite any file in the VRP virtual machine. A malicious VRP user could use this to replace existing files to take control of the VRP virtual machine.

Do I need to act?

4.9% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (11)

Resiliency Platform

Affected Vendors

Veritas

References (6)

Third Party Advisory http://packetstormsecurity.com/files/153842/Veritas-Resiliency-Platform-VRP-Trav...

Broken Link http://seclists.org/fulldisclosure/2019/Jul/39

Vendor Advisory https://www.veritas.com/content/support/en_US/security/VTS19-002.html#Issue1

Third Party Advisory http://packetstormsecurity.com/files/153842/Veritas-Resiliency-Platform-VRP-Trav...

Broken Link http://seclists.org/fulldisclosure/2019/Jul/39

Vendor Advisory https://www.veritas.com/content/support/en_US/security/VTS19-002.html#Issue1

/ 100

high-risk

Severity 30/34 · Critical

Exploitability 8/34 · Low

Exposure 16/34 · Moderate