Actively exploited · Published Mar 10, 2023 · Assigned by hackerone
CVE-2023-27532
High 7.5 Exploited Ransomware
In plain English
A high-severity missing authentication in Veeam Backup & Replication. Attackers are actively exploiting it in the wild (listed by CISA on August 22, 2023). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 80.6% (higher than 99.6% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Sep 12, 2023.
Official description
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Veeam Backup & Replication | Fixed Versions: v12 (build 12.0.0.1420 P20230223)11a (build 11.0.1.1261 P20230227) |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N