Veeam Backup Replication
CVE-2024-29852
LOW
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (hackerone) · only source for this CVE.
CVSS VectorVendor: hackerone
Lifecycle Timeline
1DescriptionCVE.org
Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs.
AnalysisAI
Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-280. Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs. Affected products include: Veeam Veeam Backup \& Replication.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Veeam Backup Replication
View allA deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code exec
VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, w
Veeam Backup & Replication allows a user with the Backup Viewer role (read-only) to escalate to remote code execution as
A second RCE vulnerability in Veeam Backup & Replication allows any authenticated domain user to execute code on the Bac
Veeam Backup & Replication allows an authenticated domain user to achieve remote code execution on the Backup Server. Wi
Yet another Veeam Backup & Replication RCE vulnerability allowing authenticated domain users to execute code on the Back
Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2). Rated critical severity (CVSS 9.8)
Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserializati
Veeam Backup & Replication allows Backup Administrators to achieve RCE in high-availability deployments. While requiring
Veeam allows Backup Operators to execute code as postgres via malicious interval or order parameters. Another operator-t
Veeam allows Backup Administrators to execute code as postgres via a malicious password parameter. Scope change means OS
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today