Skip to content
OpenAdvisories
Medium · 6.5 CVE-2024-22021 EUVD-2024-19627GHSA-3jx4-3grj-xm5w

Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retrieve plans from a Sc…

Published Feb 7, 2024 · Updated Mar 2, 2026 · Assigned by hackerone

Vendor: Veeam Product: Availability Orchestrator Product: Disaster Recovery Orchestrator Product: Recovery Orchestrator

Description

Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retrieve plans from a Scope other than the one they are assigned to.

Affected products

VendorProductAffectedFixed
Veeam Recovery Orchestrator 6 – < 6 6
Veeam Disaster Recovery Orchestrator 5 – < 5 5
Veeam Availability Orchestrator 4 – < 4 4

References