Descripción
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
Acción recomendada
Aplicar las actualizaciones según las instrucciones del fabricante.
Referencias
- Aviso de veeam.com veeam.com/kb4288
- Ficha en NVD (NIST) nvd.nist.gov/vuln/detail/CVE-2022-26500
Otras vulnerabilidades de Veeam en el catálogo
- CVE-2024-40711 Veeam Backup and Replication Deserialization Vulnerability Alta 17-10-2024
- CVE-2023-27532 Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability Alta 22-08-2023
- CVE-2022-26501 Veeam Backup & Replication Remote Code Execution Vulnerability Alta 13-12-2022