Veeam Backup Replication
CVE-2024-39718
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account.
AnalysisAI
An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account. Affected products include: Veeam Veeam Backup \& Replication.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Veeam Backup Replication
View allA deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code exec
VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, w
A second RCE vulnerability in Veeam Backup & Replication allows any authenticated domain user to execute code on the Bac
Veeam Backup & Replication allows an authenticated domain user to achieve remote code execution on the Backup Server. Wi
Yet another Veeam Backup & Replication RCE vulnerability allowing authenticated domain users to execute code on the Back
Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2). Rated critical severity (CVSS 9.8)
Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserializati
Veeam Backup & Replication allows Backup Administrators to achieve RCE in high-availability deployments. While requiring
Veeam allows Backup or Tape Operators to write files as root on the server. An operator-level role achieving root file w
Authenticated domain users can bypass file access restrictions on Backup Repository systems to read, modify, or delete a
A vulnerability in Veeam Backup & Replication platform allows a low-privileged user with a specific role to exploit a me
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today