CVE-2024-42451

A vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved credentials in plaintext

High · published December 4, 2024

CVSS v3.0
7.7
EPSS
0%
Percentile
19.3
In the wild
Unconfirmed
What it is

A vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved credentials in plaintext. This is achieved by calling a series of methods over an external protocol, ultimately retrieving the credentials using a malicious setup on the attacker's side. This exposes sensitive data, which could be used for further attacks, including unauthorized access to systems managed by the platform.

The record
Technical detail
CVSS v3.0
7.7 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00279 · 19.3th percentile
Published
2024-12-04T01:06Z
EPSS history
Timeline
  • 04 DEC 01:06Z
    A vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved credentials in plaintext
    cvelistv5