PT-2024-29953 · Veeam · Veeam Backup & Replication

Published 2024-12-03 · Updated 2025-04-24 · CVE-2024-42452

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Veeam Backup & Replication (affected versions not specified)

Description A vulnerability in Veeam Backup & Replication allows a low-privileged user to start an agent remotely in server mode and obtain credentials, effectively escalating privileges to system-level access. This allows the attacker to upload files to the server with elevated privileges. The vulnerability exists because remote calls bypass permission checks, leading to full system compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-42452

Affected Products

Veeam Backup & Replication

References · 8

• https://osv.dev/vulnerability/CVE-2024-42452 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42452 · Security Note
• https://veeam.com/kb4693 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1864220161474969782 · Twitter Post
• https://t.me/cvedetector/11933 · Telegram Post
• https://twitter.com/CveFindCom/status/1864128550757933560 · Twitter Post
• https://twitter.com/CVEnew/status/1864138615342727665 · Twitter Post
• https://t.me/cvenotify/119721 · Telegram Post