PT-2024-9559 · Veeam · Veeam Backup & Replication

Published 2024-08-02 · Updated 2025-04-24 · CVE-2024-42451

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Veeam Backup & Replication (affected versions not specified)

Description A vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved credentials in plaintext. This is achieved by calling a series of methods over an external protocol, ultimately retrieving the credentials using a malicious setup on the attacker's side. This exposes sensitive data, which could be used for further attacks, including unauthorized access to systems managed by the platform.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-863

CWE-312

Related Identifiers

BDU:2024-11266

CVE-2024-42451

Affected Products

Veeam Backup & Replication

References · 10

• https://veeam.com/kb4693 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-42451 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42451 · Security Note
• https://bdu.fstec.ru/vul/2024-11266 · Security Note
• https://twitter.com/CVEnew/status/1864138610406052292 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1864212481037553790 · Twitter Post
• https://t.me/cvedetector/11932 · Telegram Post
• https://t.me/cvenotify/102972 · Telegram Post
• https://vuldb.com/?id.286800 · Note
• https://t.me/cvenotify/119720 · Telegram Post