PT-2024-5947 · Veeam · Veeam Service Provider Console

Published 2024-09-04 · Updated 2024-10-19 · CVE-2024-39714

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Veeam Service Provider Console (VSPC) (affected versions not specified)

Description The issue is related to a code injection vulnerability that allows a low-privileged user to upload arbitrary files to the server, leading to remote code execution on the VSPC server. This vulnerability is associated with an unlimited upload of dangerous file types. Exploitation of this issue may enable a remote attacker to execute arbitrary code on the VSPC server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Code Injection

Weakness Enumeration

CWE-434

CWE-94

Related Identifiers

BDU:2024-06754

CVE-2024-39714

Affected Products

Veeam Service Provider Console

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2024-39714 · Security Note
• https://bdu.fstec.ru/vul/2024-06754 · Security Note
• https://veeam.com/kb4649 · Note
• https://t.me/aptreports/13438 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1831585450634461282 · Twitter Post
• https://twitter.com/pravin_karthik/status/1831692998754889930 · Twitter Post
• https://twitter.com/CVEnew/status/1832459144575775091 · Twitter Post
• https://twitter.com/rst_cloud/status/1847702210320150641 · Twitter Post
• https://t.me/pentestingnews/51099 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1832487716237213704 · Twitter Post
• https://twitter.com/CveFindCom/status/1832457123931836464 · Twitter Post
• https://twitter.com/fletch_ai/status/1831935477617754328 · Twitter Post
• https://t.me/cvenotify/93695 · Telegram Post
• https://t.me/cvedetector/5049 · Telegram Post
• https://t.me/cvenotify/93850 · Telegram Post