#VU74470 Improper Authentication in Backup Exec - CVE-2021-27876
Published: April 5, 2023
Vulnerability identifier: #VU74470
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Amber
CVE-ID: CVE-2021-27876
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerable software:
Backup Exec
Backup Exec
Software vendor:
Veritas Technologies
Veritas Technologies
Description
The vulnerability allows a remote user to compromise the affected system.
The vulnerability exists due to an error in SHA Authentication scheme. A remote user can use specially crafted input parameters on one of the data management protocol commands to access an arbitrary file on the system using System privileges.
Remediation
Install updates from vendor's website.