Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Veeam ONE ausnutzen, um beliebigen Code mit Administratorrechten auszuführen, Produktkonfigurationsdateien zu ändern oder vertrauliche Informationen offenzulegen.
Product
Veeam One ist eine Lösung für virtuelle Systeme, die diverse Monitoring- und Reporting-Funktionen bereitstellt.
Vulnerabilities 6
-
Critical 9.1
A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform rem…
-
Critical 9.0
A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This att…
-
High 7.8
An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remo…
-
High 7.5
An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials.
-
High 7.5
An incorrect permission assignment vulnerability allows an attacker to modify product configuration files.
-
High 7.3
A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection.
Revision history
-
#1
Initiale Fassung
References
-
Veeam Security Bulletin September 2024 vom 2024-09-04
https://www.veeam.com/kb4649