← Vulnerability feed

Vulnerability record · CVE-2022-42307 · published 3 October 2022

CVE-2022-42307: Veritas netbackup xml external entity (xxe) vulnerability

VVeritas · Netbackup

An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) Injection attack through the DiscoveryService service.

9.8 CVSS 3.1 Critical EPSS 0.56% · top 55.5% CWE-611 · XML external entity (XXE)
9.8CVSS 3.1 base score
0.56%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) Injection attack through the DiscoveryService service.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.veritas.com/content/support/en_US/security/VTS22-012#M2 PatchVendor Advisory
https://www.veritas.com/content/support/en_US/security/VTS22-012#M2 PatchVendor Advisory

Track CVE-2022-42307 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-28222Veritas netbackup path traversal vulnerabilityIn Veritas NetBackup before 8.1.2 and NetBackup Appliance before 3.1.2, the BPCD process inadequately validates the file path, allowing an unauthenti…EPSS 0.99%9.8CVE-2022-42303Veritas netbackup sql injection vulnerabilityAn issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a second-order …EPSS 0.54%9.8CVE-2022-42304Veritas netbackup sql injection vulnerabilityAn issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a SQL Injection…EPSS 0.54%9.8CVE-2022-42302Veritas netbackup sql injection vulnerabilityAn issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a SQL Injection…EPSS 0.56%9.8CVE-2022-36986Veritas flex appliance vulnerabilityAn issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and rel…EPSS 0.95%9.8CVE-2022-36952Veritas netbackup hard-coded credentials vulnerabilityIn Veritas NetBackup OpsCenter, a hard-coded credential exists that could be used to exploit the underlying VxSS subsystem. This affects 8.x through …EPSS 0.51%9.8CVE-2022-36950Veritas netbackup vulnerabilityIn Veritas NetBackup OpsCenter, an unauthenticated remote attacker may be able to perform remote command execution through a Java classloader manipul…EPSS 1.8%9.8CVE-2022-36951Veritas netbackup vulnerabilityIn Veritas NetBackup OpsCenter, an unauthenticated remote attacker may compromise the host by exploiting an incorrectly patched vulnerability. This a…EPSS 1.2%

Source: NIST National Vulnerability Database (record CVE-2022-42307), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.