CVE-2017-6406

An issue was discovered in Veritas NetBackup Before 7.7.2 and NetBackup Appliance Before 2.7.2. Arbitrary privileged command execution, using whitelist directory escape with "../" substrings, can occur.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
LOCAL
LOW
LOW
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 21%
VendorProductVersion
veritasaccess
𝑥
≤ 7.2.1
veritasnetbackup
𝑥
≤ 7.7.1
veritasnetbackup_appliance
𝑥
≤ 2.7.1
𝑥
= Vulnerable software versions
References
http://www.securityfocus.com/bid/96486
https://www.veritas.com/content/support/en_US/security/VTS17-003.html#Issue5
http://www.securityfocus.com/bid/96486
https://www.veritas.com/content/support/en_US/security/VTS17-003.html#Issue5