Vulnerability-Lookup - Search a vulnerability

Search criteria

Vendor

Product

Assigner

Sources

Sort by

Order

CERTFR-2024-AVI-1039

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits Veeam. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Veeam	Veeam Service Provider Console	Veeam Service Provider Console versions antérieures à 8.1.0.21999
Veeam	Veeam Agent	Veeam Agent pour Microsoft Windows versions antérieures à 6.3.0.177
Veeam	Veeam Backup & Replication	Veeam Backup & Replication versions antérieures à 12.3.0.310

References

Title

Publication Time

Tags

Bulletin de sécurité Veeam kb4693	2024-12-03	vendor-advisory
Bulletin de sécurité Veeam kb4679	2024-12-03	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Veeam Service Provider Console versions ant\u00e9rieures \u00e0 8.1.0.21999",
      "product": {
        "name": "Veeam Service Provider Console",
        "vendor": {
          "name": "Veeam",
          "scada": false
        }
      }
    },
    {
      "description": "Veeam Agent pour Microsoft Windows versions ant\u00e9rieures \u00e0 6.3.0.177",
      "product": {
        "name": "Veeam Agent",
        "vendor": {
          "name": "Veeam",
          "scada": false
        }
      }
    },
    {
      "description": "Veeam Backup \u0026 Replication versions ant\u00e9rieures \u00e0 12.3.0.310",
      "product": {
        "name": "Veeam Backup \u0026 Replication",
        "vendor": {
          "name": "Veeam",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-40717",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40717"
    },
    {
      "name": "CVE-2024-42453",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42453"
    },
    {
      "name": "CVE-2024-42456",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42456"
    },
    {
      "name": "CVE-2024-45204",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45204"
    },
    {
      "name": "CVE-2024-42457",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42457"
    },
    {
      "name": "CVE-2024-42449",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42449"
    },
    {
      "name": "CVE-2024-42452",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42452"
    },
    {
      "name": "CVE-2024-42451",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42451"
    },
    {
      "name": "CVE-2024-45207",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45207"
    },
    {
      "name": "CVE-2024-42455",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42455"
    },
    {
      "name": "CVE-2024-42448",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42448"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-1039",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-12-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Veeam. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Veeam",
  "vendor_advisories": [
    {
      "published_at": "2024-12-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Veeam kb4693",
      "url": "https://www.veeam.com/kb4693"
    },
    {
      "published_at": "2024-12-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Veeam kb4679",
      "url": "https://www.veeam.com/kb4679"
    }
  ]
}

CERTFR-2024-AVI-0740

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits Veeam. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Veeam	Veeam Backup	Veeam Backup pour Oracle Linux Virtualization Manager et Red Hat Virtualization versions antérieures à 12.5.0.299
Veeam	Veeam Backup	Veeam Backup pour Nutanix AHV versions antérieures à 12.6.0.632
Veeam	Veeam ONE	Veeam ONE versions antérieures à 12.2.0.4093
Veeam	Veeam Backup & Replication	Veeam Backup & Replication versions antérieures à 12.2.0.334
Veeam	Veeam Service Provider Console	Veeam Service Provider Console versions antérieures à 8.1.0.21377
Veeam	Veeam Agent	Veeam Agent pour Linux versions antérieures à 6.2.0.101

References

Title

Publication Time

Tags

Bulletin de sécurité Veeam kb4649

2024-09-04

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Veeam Backup pour Oracle Linux Virtualization Manager et Red Hat Virtualization versions ant\u00e9rieures \u00e0 12.5.0.299",
      "product": {
        "name": "Veeam Backup",
        "vendor": {
          "name": "Veeam",
          "scada": false
        }
      }
    },
    {
      "description": "Veeam Backup pour Nutanix AHV versions ant\u00e9rieures \u00e0 12.6.0.632",
      "product": {
        "name": "Veeam Backup",
        "vendor": {
          "name": "Veeam",
          "scada": false
        }
      }
    },
    {
      "description": "Veeam ONE versions ant\u00e9rieures \u00e0 12.2.0.4093",
      "product": {
        "name": "Veeam ONE",
        "vendor": {
          "name": "Veeam",
          "scada": false
        }
      }
    },
    {
      "description": "Veeam Backup \u0026 Replication versions ant\u00e9rieures \u00e0 12.2.0.334",
      "product": {
        "name": "Veeam Backup \u0026 Replication",
        "vendor": {
          "name": "Veeam",
          "scada": false
        }
      }
    },
    {
      "description": "Veeam Service Provider Console versions ant\u00e9rieures \u00e0 8.1.0.21377",
      "product": {
        "name": "Veeam Service Provider Console",
        "vendor": {
          "name": "Veeam",
          "scada": false
        }
      }
    },
    {
      "description": "Veeam Agent pour Linux versions ant\u00e9rieures \u00e0 6.2.0.101",
      "product": {
        "name": "Veeam Agent",
        "vendor": {
          "name": "Veeam",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-39714",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39714"
    },
    {
      "name": "CVE-2024-40718",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40718"
    },
    {
      "name": "CVE-2024-42019",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42019"
    },
    {
      "name": "CVE-2024-38650",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38650"
    },
    {
      "name": "CVE-2024-38651",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38651"
    },
    {
      "name": "CVE-2024-39718",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39718"
    },
    {
      "name": "CVE-2024-40712",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40712"
    },
    {
      "name": "CVE-2024-42023",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42023"
    },
    {
      "name": "CVE-2024-40710",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40710"
    },
    {
      "name": "CVE-2024-42022",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42022"
    },
    {
      "name": "CVE-2024-42020",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42020"
    },
    {
      "name": "CVE-2024-39715",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39715"
    },
    {
      "name": "CVE-2024-40714",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40714"
    },
    {
      "name": "CVE-2024-42021",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42021"
    },
    {
      "name": "CVE-2024-40713",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40713"
    },
    {
      "name": "CVE-2024-40709",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40709"
    },
    {
      "name": "CVE-2024-42024",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42024"
    },
    {
      "name": "CVE-2024-40711",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40711"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0740",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-09-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Veeam. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Veeam",
  "vendor_advisories": [
    {
      "published_at": "2024-09-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Veeam kb4649",
      "url": "https://www.veeam.com/kb4649"
    }
  ]
}

CERTFR-2024-AVI-0374

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité a été découverte dans Veeam Service Provider Console. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Veeam	Veeam Service Provider Console	Service Provider Console versions 7.x antérieures à 7.0.0.18899
	Veeam	Veeam Service Provider Console	Service Provider Console versions 8.x antérieures à 8.0.0.19236

References

Title

Publication Time

Tags

Bulletin de sécurité Veeam kb4575 du 07 mai 2024

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Service Provider Console versions 7.x ant\u00e9rieures \u00e0 7.0.0.18899",
      "product": {
        "name": "Veeam Service Provider Console",
        "vendor": {
          "name": "Veeam",
          "scada": false
        }
      }
    },
    {
      "description": "Service Provider Console versions 8.x ant\u00e9rieures \u00e0 8.0.0.19236",
      "product": {
        "name": "Veeam Service Provider Console",
        "vendor": {
          "name": "Veeam",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2024-29212",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-29212"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0374",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-05-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans\u003cspan class=\"textit\"\u003e Veeam\nService Provider Console\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Veeam Service Provider Console",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Veeam kb4575 du 07 mai 2024",
      "url": "https://www.veeam.com/kb4575"
    }
  ]
}

CVE-2024-39714 (GCVE-0-2024-39714)

Vulnerability from cvelistv5 – Published: 2024-09-07 16:11 – Updated: 2024-09-09 16:23

Summary

A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution on VSPC server.

Severity ?

9.9 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

hackerone

References

URL

Tags

https://www.veeam.com/kb4649

Impacted products

	Vendor	Product	Version
	Veeam	Veeam Service Provider Console	Affected: 8 , ≤ 8 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:veeam:service_provider_console:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "service_provider_console",
            "vendor": "veeam",
            "versions": [
              {
                "lessThanOrEqual": "8.0.0.19552",
                "status": "affected",
                "version": "8",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39714",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-09T16:22:17.899275Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-09T16:23:20.600Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Veeam Service Provider Console",
          "vendor": "Veeam",
          "versions": [
            {
              "lessThanOrEqual": "8",
              "status": "affected",
              "version": "8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution on VSPC server."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-07T16:11:22.188Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://www.veeam.com/kb4649"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2024-39714",
    "datePublished": "2024-09-07T16:11:22.188Z",
    "dateReserved": "2024-06-28T01:04:08.821Z",
    "dateUpdated": "2024-09-09T16:23:20.600Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-39715 (GCVE-0-2024-39715)

Vulnerability from cvelistv5 – Published: 2024-09-07 16:11 – Updated: 2024-09-09 15:15

Summary

A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST API, leading to remote code execution on VSPC server.

Severity ?

8.5 (High)


                        
                          CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

hackerone

References

URL

Tags

https://www.veeam.com/kb4649

Impacted products

	Vendor	Product	Version
	Veeam	Veeam Service Provider Console	Affected: 8 , ≤ 8 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:veeam:service_provider_console:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "service_provider_console",
            "vendor": "veeam",
            "versions": [
              {
                "lessThanOrEqual": "8.0.0.19552",
                "status": "affected",
                "version": "8",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39715",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-09T15:13:24.936483Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-09T15:15:08.789Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Veeam Service Provider Console",
          "vendor": "Veeam",
          "versions": [
            {
              "lessThanOrEqual": "8",
              "status": "affected",
              "version": "8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST API, leading to remote code execution on VSPC server."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-07T16:11:22.204Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://www.veeam.com/kb4649"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2024-39715",
    "datePublished": "2024-09-07T16:11:22.204Z",
    "dateReserved": "2024-06-28T01:04:08.821Z",
    "dateUpdated": "2024-09-09T15:15:08.789Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-38650 (GCVE-0-2024-38650)

Vulnerability from cvelistv5 – Published: 2024-09-07 16:11 – Updated: 2024-09-09 13:29

Summary

An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server.

Severity ?

9.9 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

hackerone

References

URL

Tags

https://www.veeam.com/kb4649

Impacted products

	Vendor	Product	Version
	Veeam	Veeam Service Provider Console	Affected: 8 , ≤ 8 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:veeam:service_provider_console:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "service_provider_console",
            "vendor": "veeam",
            "versions": [
              {
                "lessThanOrEqual": "8.0.0.19552",
                "status": "affected",
                "version": "8",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38650",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-09T13:14:42.800022Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-09T13:29:12.838Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Veeam Service Provider Console",
          "vendor": "Veeam",
          "versions": [
            {
              "lessThanOrEqual": "8",
              "status": "affected",
              "version": "8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-07T16:11:22.353Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://www.veeam.com/kb4649"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2024-38650",
    "datePublished": "2024-09-07T16:11:22.353Z",
    "dateReserved": "2024-06-19T01:04:07.137Z",
    "dateUpdated": "2024-09-09T13:29:12.838Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-38651 (GCVE-0-2024-38651)

Vulnerability from cvelistv5 – Published: 2024-09-07 16:11 – Updated: 2024-09-09 16:20

Summary

A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead to remote code execution on VSPC server.

Severity ?

8.5 (High)


                        
                          CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

hackerone

References

URL

Tags

https://www.veeam.com/kb4649

Impacted products

	Vendor	Product	Version
	Veeam	Veeam Service Provider Console	Affected: 8 , ≤ 8 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:veeam:service_provider_console:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "service_provider_console",
            "vendor": "veeam",
            "versions": [
              {
                "lessThanOrEqual": "8.0.0.19552",
                "status": "affected",
                "version": "8",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38651",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-09T16:19:56.829824Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-09T16:20:59.132Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Veeam Service Provider Console",
          "vendor": "Veeam",
          "versions": [
            {
              "lessThanOrEqual": "8",
              "status": "affected",
              "version": "8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead to remote code execution on VSPC server."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-07T16:11:22.198Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://www.veeam.com/kb4649"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2024-38651",
    "datePublished": "2024-09-07T16:11:22.198Z",
    "dateReserved": "2024-06-19T01:04:07.137Z",
    "dateUpdated": "2024-09-09T16:20:59.132Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-39714 (GCVE-0-2024-39714)

Vulnerability from nvd – Published: 2024-09-07 16:11 – Updated: 2024-09-09 16:23

Summary

A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution on VSPC server.

Severity ?

9.9 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

hackerone

References

URL

Tags

https://www.veeam.com/kb4649

Impacted products

	Vendor	Product	Version
	Veeam	Veeam Service Provider Console	Affected: 8 , ≤ 8 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:veeam:service_provider_console:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "service_provider_console",
            "vendor": "veeam",
            "versions": [
              {
                "lessThanOrEqual": "8.0.0.19552",
                "status": "affected",
                "version": "8",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39714",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-09T16:22:17.899275Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-09T16:23:20.600Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Veeam Service Provider Console",
          "vendor": "Veeam",
          "versions": [
            {
              "lessThanOrEqual": "8",
              "status": "affected",
              "version": "8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution on VSPC server."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-07T16:11:22.188Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://www.veeam.com/kb4649"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2024-39714",
    "datePublished": "2024-09-07T16:11:22.188Z",
    "dateReserved": "2024-06-28T01:04:08.821Z",
    "dateUpdated": "2024-09-09T16:23:20.600Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-39715 (GCVE-0-2024-39715)

Vulnerability from nvd – Published: 2024-09-07 16:11 – Updated: 2024-09-09 15:15

Summary

A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST API, leading to remote code execution on VSPC server.

Severity ?

8.5 (High)


                        
                          CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

hackerone

References

URL

Tags

https://www.veeam.com/kb4649

Impacted products

	Vendor	Product	Version
	Veeam	Veeam Service Provider Console	Affected: 8 , ≤ 8 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:veeam:service_provider_console:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "service_provider_console",
            "vendor": "veeam",
            "versions": [
              {
                "lessThanOrEqual": "8.0.0.19552",
                "status": "affected",
                "version": "8",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39715",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-09T15:13:24.936483Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-09T15:15:08.789Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Veeam Service Provider Console",
          "vendor": "Veeam",
          "versions": [
            {
              "lessThanOrEqual": "8",
              "status": "affected",
              "version": "8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST API, leading to remote code execution on VSPC server."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-07T16:11:22.204Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://www.veeam.com/kb4649"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2024-39715",
    "datePublished": "2024-09-07T16:11:22.204Z",
    "dateReserved": "2024-06-28T01:04:08.821Z",
    "dateUpdated": "2024-09-09T15:15:08.789Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-38650 (GCVE-0-2024-38650)

Vulnerability from nvd – Published: 2024-09-07 16:11 – Updated: 2024-09-09 13:29

Summary

An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server.

Severity ?

9.9 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

hackerone

References

URL

Tags

https://www.veeam.com/kb4649

Impacted products

	Vendor	Product	Version
	Veeam	Veeam Service Provider Console	Affected: 8 , ≤ 8 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:veeam:service_provider_console:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "service_provider_console",
            "vendor": "veeam",
            "versions": [
              {
                "lessThanOrEqual": "8.0.0.19552",
                "status": "affected",
                "version": "8",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38650",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-09T13:14:42.800022Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-09T13:29:12.838Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Veeam Service Provider Console",
          "vendor": "Veeam",
          "versions": [
            {
              "lessThanOrEqual": "8",
              "status": "affected",
              "version": "8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-07T16:11:22.353Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://www.veeam.com/kb4649"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2024-38650",
    "datePublished": "2024-09-07T16:11:22.353Z",
    "dateReserved": "2024-06-19T01:04:07.137Z",
    "dateUpdated": "2024-09-09T13:29:12.838Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-38651 (GCVE-0-2024-38651)

Vulnerability from nvd – Published: 2024-09-07 16:11 – Updated: 2024-09-09 16:20

Summary

A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead to remote code execution on VSPC server.

Severity ?

8.5 (High)


                        
                          CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

hackerone

References

URL

Tags

https://www.veeam.com/kb4649

Impacted products

	Vendor	Product	Version
	Veeam	Veeam Service Provider Console	Affected: 8 , ≤ 8 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:veeam:service_provider_console:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "service_provider_console",
            "vendor": "veeam",
            "versions": [
              {
                "lessThanOrEqual": "8.0.0.19552",
                "status": "affected",
                "version": "8",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38651",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-09T16:19:56.829824Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-09T16:20:59.132Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Veeam Service Provider Console",
          "vendor": "Veeam",
          "versions": [
            {
              "lessThanOrEqual": "8",
              "status": "affected",
              "version": "8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead to remote code execution on VSPC server."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-07T16:11:22.198Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://www.veeam.com/kb4649"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2024-38651",
    "datePublished": "2024-09-07T16:11:22.198Z",
    "dateReserved": "2024-06-19T01:04:07.137Z",
    "dateUpdated": "2024-09-09T16:20:59.132Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Search criteria

14 vulnerabilities found for Veeam Service Provider Console by Veeam

CERTFR-2024-AVI-1039

Solutions

CERTFR-2024-AVI-0740

Solutions

CERTFR-2024-AVI-0374

Solution

CVE-2024-39714 (GCVE-0-2024-39714)

CVE-2024-39715 (GCVE-0-2024-39715)

CVE-2024-38650 (GCVE-0-2024-38650)

CVE-2024-38651 (GCVE-0-2024-38651)

CVE-2024-39714 (GCVE-0-2024-39714)

CVE-2024-39715 (GCVE-0-2024-39715)

CVE-2024-38650 (GCVE-0-2024-38650)

CVE-2024-38651 (GCVE-0-2024-38651)