Vulnerability · Published Dec 4, 2024 · Assigned by hackerone
CVE-2024-42452
High 8.8
In plain English
A high-severity incorrect authorization in Backup & Replication from Veeam. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Official description
A vulnerability in Veeam Backup & Replication allows a low-privileged user to start an agent remotely in server mode and obtain credentials, effectively escalating privileges to system-level access. This allows the attacker to upload files to the server with elevated privileges. The vulnerability exists because remote calls bypass permission checks, leading to full system compromise.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Veeam | Backup & Replication | 12.2 – through 12.2 |
Weakness: CWE-863 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H