CVE-2024-42453

A vulnerability Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastructure hosts. This includes the ability to power off virtual machines, delete files in storage, and make configuration changes, potentially leading to Denial of Service (DoS) and data integrity issues. The vulnerability is caused by improper permission checks in methods accessed via management services.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.veeam.com/kb4693	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:*

History

24 Apr 2025, 17:11

Type	Values Removed	Values Added
CPE		cpe:2.3:a:veeam:veeam_backup_\&_replication::::::::
References	~~() https://www.veeam.com/kb4693 -~~	() https://www.veeam.com/kb4693 - Vendor Advisory
First Time		Veeam veeam Backup \& Replication Veeam
CVSS	v2 : ~~unknown~~ v3 : ~~7.4~~	v2 : unknown v3 : 8.1

04 Dec 2024, 15:15

Type	Values Removed	Values Added
CWE		CWE-862
Summary		(es) Una vulnerabilidad de Veeam Backup & Replication permite a los usuarios con pocos privilegios controlar y modificar las configuraciones de los hosts de infraestructura virtual conectados. Esto incluye la capacidad de apagar máquinas virtuales, eliminar archivos del almacenamiento y realizar cambios de configuración, lo que puede provocar denegación de servicio (DoS) y problemas de integridad de los datos. La vulnerabilidad se debe a comprobaciones de permisos incorrectas en los métodos a los que se accede a través de los servicios de administración.

04 Dec 2024, 02:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-04 02:15

Updated : 2025-04-24 17:11

NVD link : CVE-2024-42453

Mitre link : CVE-2024-42453

CVE.ORG link : CVE-2024-42453

JSON object : View

Products Affected

veeam

veeam_backup_\&_replication

CWE

CWE-862

Missing Authorization

{"id": "CVE-2024-42453", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "support@hackerone.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 3.1}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2024-12-04T02:15:04.837", "references": [{"url": "https://www.veeam.com/kb4693", "tags": ["Vendor Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastructure hosts. This includes the ability to power off virtual machines, delete files in storage, and make configuration changes, potentially leading to Denial of Service (DoS) and data integrity issues. The vulnerability is caused by improper permission checks in methods accessed via management services."}, {"lang": "es", "value": "Una vulnerabilidad de Veeam Backup & Replication permite a los usuarios con pocos privilegios controlar y modificar las configuraciones de los hosts de infraestructura virtual conectados. Esto incluye la capacidad de apagar m\u00e1quinas virtuales, eliminar archivos del almacenamiento y realizar cambios de configuraci\u00f3n, lo que puede provocar denegaci\u00f3n de servicio (DoS) y problemas de integridad de los datos. La vulnerabilidad se debe a comprobaciones de permisos incorrectas en los m\u00e9todos a los que se accede a trav\u00e9s de los servicios de administraci\u00f3n."}], "lastModified": "2025-04-24T17:11:34.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:veeam:veeam_backup_\\&_replication:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "97D6D507-5200-44A1-9122-C3CF8660C1C7", "versionEndExcluding": "12.3.0.310", "versionStartIncluding": "12.0.0.1402"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}