DeutschShown in its original language — a full translation is planned for a future version.
Veeam Backup & Replication: Mehrere Schwachstellen
view advisory published 2024-09-04
Ein Angreifer kann mehrere Schwachstellen in Veeam Backup & Replication ausnutzen, um Dateien zu manipulieren, erweiterte Rechte zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen und vertrauliche Informationen preiszugeben.
01
describes (6)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-40714US | high8.3 | — | ||
An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations. | ||||
| CVE-2024-40713US | high7.8 | — | ||
A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) settings and bypass MFA. | ||||
| CVE-2024-40712US | high7.8 | — | ||
A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE). | ||||
| CVE-2024-40711US | critical9.8OT critical | KEV | ||
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE). | ||||
| CVE-2024-40710US | high8.8 | — | ||
A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive information (savedcreden… | ||||
| CVE-2024-39718US | high8.1 | — | ||
An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account. | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan