Descripción
Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.
Acción recomendada
Aplicar las mitigaciones del fabricante; si no están disponibles, discontinuar el uso del producto.
Referencias
- Aviso de veeam.com veeam.com/kb4424
- Ficha en NVD (NIST) nvd.nist.gov/vuln/detail/CVE-2023-27532
Otras vulnerabilidades de Veeam en el catálogo
- CVE-2024-40711 Veeam Backup and Replication Deserialization Vulnerability Alta 17-10-2024
- CVE-2022-26501 Veeam Backup & Replication Remote Code Execution Vulnerability Alta 13-12-2022
- CVE-2022-26500 Veeam Backup & Replication Remote Code Execution Vulnerability Alta 13-12-2022