Vulnerability · Published Dec 4, 2024 · Assigned by hackerone
CVE-2024-42457
High 7.7
In plain English
A high-severity security flaw in Backup & Replication from Veeam. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Official description
A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by leveraging a combination of methods in a remote management interface. This can be achieved using a session object that allows for credential enumeration and exploitation, leading to the leak of plaintext credentials to a malicious host. The attack is facilitated by improper usage of a method that allows operators to add a new host with an attacker-controlled IP, enabling them to retrieve sensitive credentials in plaintext.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Veeam | Backup & Replication | 12.2 – through 12.2 |
Weakness: CWE-522 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N