PT-2024-9557 · Veeam · Veeam Backup & Replication

Published 2024-09-04 · Updated 2025-05-08 · CVE-2024-39718

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Veeam Backup & Replication (affected versions not specified)

Description The issue is related to an improper input validation vulnerability. This vulnerability allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account. The vulnerability is also associated with a path traversal restriction in Veeam Backup & Replication, which can be exploited by a remote attacker to impact the integrity and availability of protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-11264

CVE-2024-39718

Affected Products

Veeam Backup & Replication

References · 13

• https://osv.dev/vulnerability/CVE-2024-39718 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-11264 · Security Note
• https://veeam.com/kb4649 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39718 · Security Note
• https://t.me/cvenotify/93697 · Telegram Post
• https://t.me/aptreports/13438 · Telegram Post
• https://t.me/cvedetector/5052 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2024090618 · Note
• https://t.me/cvenotify/121347 · Telegram Post
• https://twitter.com/CVEnew/status/1832459146895225051 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1832489228921381365 · Twitter Post
• https://twitter.com/rst_cloud/status/1847702147929886963 · Twitter Post
• https://twitter.com/patchnow24x7/status/1831693778652164598 · Twitter Post