cve-2024-42024
Vulnerability from cvelistv5
Published
2024-09-07 16:11
Modified
2024-09-09 14:11
Severity
Summary
A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution on the machine where the Veeam ONE Agent is installed.
References
Source | URL | Tags |
---|---|---|
support@hackerone.com | https://www.veeam.com/kb4649 |
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:a:veeam:one:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "one", "vendor": "veeam", "versions": [ { "lessThanOrEqual": "12.1.0.3208", "status": "affected", "version": "12", "versionType": "semver" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-42024", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-09-09T14:04:05.003945Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-250", "description": "CWE-250 Execution with Unnecessary Privileges", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-09-09T14:11:39.524Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "One", "vendor": "Veeam", "versions": [ { "lessThanOrEqual": "12.1", "status": "affected", "version": "12.1", "versionType": "semver" } ] } ], "descriptions": [ { "lang": "en", "value": "A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution on the machine where the Veeam ONE Agent is installed." } ], "metrics": [ { "cvssV3_0": { "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.0" } } ], "providerMetadata": { "dateUpdated": "2024-09-07T16:11:22.220Z", "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone" }, "references": [ { "url": "https://www.veeam.com/kb4649" } ] } }, "cveMetadata": { "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "assignerShortName": "hackerone", "cveId": "CVE-2024-42024", "datePublished": "2024-09-07T16:11:22.220Z", "dateReserved": "2024-07-27T01:04:08.013Z", "dateUpdated": "2024-09-09T14:11:39.524Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2024-42024\",\"sourceIdentifier\":\"support@hackerone.com\",\"published\":\"2024-09-07T17:15:14.700\",\"lastModified\":\"2024-09-09T14:35:06.053\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution on the machine where the Veeam ONE Agent is installed.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad que permite a un atacante en posesi\u00f3n de las credenciales de la cuenta de servicio de Veeam ONE Agent realizar una ejecuci\u00f3n remota de c\u00f3digo en la m\u00e1quina donde est\u00e1 instalado Veeam ONE Agent.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"support@hackerone.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\"},\"exploitabilityScore\":2.3,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-250\"}]}],\"references\":[{\"url\":\"https://www.veeam.com/kb4649\",\"source\":\"support@hackerone.com\"}]}}" } }
Loading...