Veeam Backup Replication
CVE-2024-45204
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
A vulnerability exists where a low-privileged user can exploit insufficient permissions in credential handling to leak NTLM hashes of saved credentials. The exploitation involves using retrieved credentials to expose sensitive NTLM hashes, impacting systems beyond the initial target and potentially leading to broader security vulnerabilities.
AnalysisAI
A vulnerability exists where a low-privileged user can exploit insufficient permissions in credential handling to leak NTLM hashes of saved credentials. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Incorrect Authorization (CWE-863), which allows attackers to bypass authorization checks to access restricted resources. A vulnerability exists where a low-privileged user can exploit insufficient permissions in credential handling to leak NTLM hashes of saved credentials. The exploitation involves using retrieved credentials to expose sensitive NTLM hashes, impacting systems beyond the initial target and potentially leading to broader security vulnerabilities. Affected products include: Veeam Veeam Backup \& Replication.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Review and test authorization logic, implement consistent access control checks, use centralized authorization framework.
More in Veeam Backup Replication
View allA deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code exec
VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, w
A second RCE vulnerability in Veeam Backup & Replication allows any authenticated domain user to execute code on the Bac
Veeam Backup & Replication allows an authenticated domain user to achieve remote code execution on the Backup Server. Wi
Yet another Veeam Backup & Replication RCE vulnerability allowing authenticated domain users to execute code on the Back
Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2). Rated critical severity (CVSS 9.8)
Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserializati
Veeam Backup & Replication allows Backup Administrators to achieve RCE in high-availability deployments. While requiring
Veeam allows Backup or Tape Operators to write files as root on the server. An operator-level role achieving root file w
Authenticated domain users can bypass file access restrictions on Backup Repository systems to read, modify, or delete a
A vulnerability in Veeam Backup & Replication platform allows a low-privileged user with a specific role to exploit a me
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today