Vulnerability Description
A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by leveraging a combination of methods in a remote management interface. This can be achieved using a session object that allows for credential enumeration and exploitation, leading to the leak of plaintext credentials to a malicious host. The attack is facilitated by improper usage of a method that allows operators to add a new host with an attacker-controlled IP, enabling them to retrieve sensitive credentials in plaintext.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Veeam | Veeam Backup \& Replication | >= 12.0.0.1402, < 12.3.0.310 |
Related Weaknesses (CWE)
References
- https://www.veeam.com/kb4693Vendor Advisory
FAQ
What is CVE-2024-42457?
CVE-2024-42457 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by leveraging a combination of methods in a remote management interface. This can be ...
How severe is CVE-2024-42457?
CVE-2024-42457 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-42457?
Check the references section above for vendor advisories and patch information. Affected products include: Veeam Veeam Backup \& Replication.