Veeam fixes 5 vulnerabilities in 2 products

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Veeam fixes 5 vulnerabilities in 2 products

Veeam is fixing 5 vulnerabilities in Veeam Backup & Replication (specifically Veeam Backup Enterprise Manager (VBEM)) and Veeam Agent for Windows (VAW). The vulnerabilities are fixed in Veeam Backup & Replication in version 12.1.2 (build 12.1.2.172) and in Veeam Agent for Windows in version 6.1.2 (build 6.1.2.134) [1][2].

VBEM - authentication bypass (CVE-2024-29849)

CVSS 9.8 (Critical)

An unauthenticated remote attacker can bypass authentication for any account in VBEM by sending a specially crafted login request and using their own authentication server [1]. A PoC has been published for the vulnerability [3] and details of the vulnerability can be found at [4].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

CVE-2024-29849 at cve.org, NVD
CWE-287 at cwe.mitre.org

The vulnerability was publicly disclosed 21. 5. 2024.

VBEM - account takeover (CVE-2024-29850)

CVSS 8.8 (High)

An unauthenticated remote attacker can take over a user account in VBEM using an NTLM relay attack [1].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

CVE-2024-29850 at cve.org, NVD
CWE-294 at cwe.mitre.org

The vulnerability was publicly disclosed 21. 5. 2024.

VBEM - NTLM hash leak (CVE-2024-29851)

CVSS 7.2 (High)

An authenticated remote attacker can obtain the NTLM hash of a service account without authorization in VBEM [1].

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

CVE-2024-29851 at cve.org, NVD
CWE-200 at cwe.mitre.org

The vulnerability was publicly disclosed 21. 5. 2024.

VBEM - information leak (CVE-2024-29852)

CVSS 2.7 (Low)

An authenticated remote attacker can gain unauthorized access to information from log files in VBEM [1].

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

More information:

CVE-2024-29852 at cve.org, NVD
CWE-200 at cwe.mitre.org

The vulnerability was publicly disclosed 21. 5. 2024.

VAW - privilege escalation (CVE-2024-29853)

CVSS 7.8 (High)

A local authenticated attacker can perform privilege escalation in VAW [2].

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

CVE-2024-29853 at cve.org, NVD
CWE-269 at cwe.mitre.org

The vulnerability was publicly disclosed 21. 5. 2024.

Links

By CESNET, z.s.p.o. Martin Krajči on 11. 6. 2024.

Report feedback

[TLP:CLEAR] Veeam fixes 5 vulnerabilities in 2 products

VBEM - authentication bypass (CVE-2024-29849)

CVSS 9.8 (Critical)

VBEM - account takeover (CVE-2024-29850)

CVSS 8.8 (High)

VBEM - NTLM hash leak (CVE-2024-29851)

CVSS 7.2 (High)

VBEM - information leak (CVE-2024-29852)

CVSS 2.7 (Low)

VAW - privilege escalation (CVE-2024-29853)

CVSS 7.8 (High)

Links