Vulnerability · Published Feb 7, 2024 · Assigned by hackerone
CVE-2024-22022
High 8.8
In plain English
A high-severity information exposure in Availability Orchestrator from Veeam. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 3.0)8.8High
Exploit odds (30 days)0.7%top 46.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash of the service account used by the Veeam Orchestrator Server Service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Veeam | Recovery Orchestrator | 6 – before 65 – before 5 |
| Veeam | Availability Orchestrator | 4 – before 4 |
Weakness: CWE-200 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/CR:X/IR:X/AR:X