Skip to main content

Veeam Backup Replication CVE-2024-29849

CRITICAL
Improper Authentication (CWE-287)
2024-05-22 support@hackerone.com
Authentication Bypass Veeam Backup Replication
9.8
CVSS 3.0 · Vendor: hackerone
Share

Severity by source

Vendor (hackerone) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (hackerone) · only source for this CVE.

CVSS VectorVendor: hackerone

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
May 22, 2024 - 23:15 cve.org
CRITICAL 9.8

DescriptionCVE.org

Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.

AnalysisAI

Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface. Affected products include: Veeam Veeam Backup \& Replication.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.

More in Veeam Backup Replication

View all
CVE-2024-40711 CRITICAL POC
9.8 Sep 07

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code exec
CVE-2020-15518 HIGH POC
8.8 Jul 03

VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, w
CVE-2026-21667 CRITICAL
9.9 Mar 12

A second RCE vulnerability in Veeam Backup & Replication allows any authenticated domain user to execute code on the Bac
CVE-2026-21666 CRITICAL
9.9 Mar 12

Veeam Backup & Replication allows an authenticated domain user to achieve remote code execution on the Backup Server. Wi
CVE-2026-21669 CRITICAL
9.9 Mar 12

Yet another Veeam Backup & Replication RCE vulnerability allowing authenticated domain users to execute code on the Back
CVE-2022-26501 CRITICAL
9.8 Mar 17

Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2). Rated critical severity (CVSS 9.8)
CVE-2021-35971 CRITICAL
9.8 Jun 30

Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserializati
CVE-2026-21671 CRITICAL
9.1 Mar 12

Veeam Backup & Replication allows Backup Administrators to achieve RCE in high-availability deployments. While requiring
CVE-2025-59469 CRITICAL
9.0 Jan 08

Veeam allows Backup or Tape Operators to write files as root on the server. An operator-level role achieving root file w
CVE-2026-21668 HIGH
8.8 Mar 12

Authenticated domain users can bypass file access restrictions on Backup Repository systems to read, modify, or delete a
CVE-2024-42456 HIGH
8.8 Dec 04

A vulnerability in Veeam Backup & Replication platform allows a low-privileged user with a specific role to exploit a me
CVE-2024-42452 HIGH
8.8 Dec 04

A vulnerability in Veeam Backup & Replication allows a low-privileged user to start an agent remotely in server mode and

Same weakness CWE-287 – Improper Authentication

View all
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8
CVE-2024-53704 CRITICAL POC
9.8
CVE-2015-7755 CRITICAL POC
9.8
CVE-2013-0625 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2024-29849 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy