Authentication Bypass by Capture-replay in Veeam Backup Enterprise Manager - CVE-2024-29851
Published: May 27, 2024
Vulnerability identifier: #VU89816
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-29851
CWE-ID: CWE-294
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to the way the application handles authentication. A remote privileged user can obtain the NTLM hash of the Veeam Backup Enterprise Manager service account if that service account is anything other than the default Local System account and escalate privileges.
Affected software
Veeam Backup Enterprise Manager
How to mitigate CVE-2024-29851
Install updates from vendor's website.
Veeam Backup Enterprise Manager - update to 12.1.2.172