Vulnerability · Published Dec 4, 2024 · Assigned by hackerone
CVE-2024-45204
High 7.7
In plain English
A high-severity incorrect authorization in Backup & Replication from Veeam. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Severity (CVSS 3.0)7.7High
Exploit odds (30 days)0.4%top 70.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability exists where a low-privileged user can exploit insufficient permissions in credential handling to leak NTLM hashes of saved credentials. The exploitation involves using retrieved credentials to expose sensitive NTLM hashes, impacting systems beyond the initial target and potentially leading to broader security vulnerabilities.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Veeam | Backup & Replication | 12.2 – through 12.2 |
Weakness: CWE-863 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N