NLShown in its original language — a full translation is planned for a future version.
Kwetsbaarheden verholpen in diverse producten van Veeam.
view advisory published 2024-09-06
Veeam heeft kwetsbaarheden verholpen in diverse producten, zoals Backup & Replication, ONE, Service Provider Console en Agent.
01
describes (17)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-42024US | high8.8 | — | ||
A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution on the machine where the Veeam ONE Agent i… | ||||
| CVE-2024-42022US | medium5.3 | — | ||
An incorrect permission assignment vulnerability allows an attacker to modify product configuration files. | ||||
| CVE-2024-42021US | medium6.5 | — | ||
An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials. | ||||
| CVE-2024-42020US | medium5.4 | — | ||
A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection. | ||||
| CVE-2024-42019US | high8.0 | — | ||
A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This attack requires user interaction and data collected from Veeam B… | ||||
| CVE-2024-40718US | — | — | ||
A server side request forgery vulnerability allows a low-privileged user to perform local privilege escalation through exploiting an SSRF vulnerability. | ||||
| CVE-2024-40714US | high8.3 | — | ||
An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations. | ||||
| CVE-2024-40713US | high7.8 | — | ||
A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) settings and bypass MFA. | ||||
| CVE-2024-40712US | high7.8 | — | ||
A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE). | ||||
| CVE-2024-40711US | critical9.8OT critical | KEV | ||
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE). | ||||
| CVE-2024-40710US | high8.8 | — | ||
A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive information (savedcreden… | ||||
| CVE-2024-40709US | —OT elevated | — | ||
A missing authorization vulnerability allows a local low-privileged user on the machine to escalate their privileges to root level. | ||||
| CVE-2024-39718US | high8.1 | — | ||
An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account. | ||||
| CVE-2024-39715US | — | — | ||
A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST API, leading to remot… | ||||
| CVE-2024-39714US | — | — | ||
A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution on VSPC server. | ||||
| CVE-2024-38651US | — | — | ||
A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead to remote code execution on VSPC server. | ||||
| CVE-2024-38650US | — | — | ||
An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server. | ||||
02
references
External citations — patches, advisories, analysis.
- Reference - ncscclearexternal
- Reference - ncscclearexternal
- Reference - certbundde; cveprojectv5; ncscclear; nvdexternal
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan