CVE-2024-38650: Infoleak

Published Sep 7, 2024

Updated

An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server.

Affected Software

1 affected component

Veeam Veeam Service Provider Console

Event History

Sep 5, 2024

News Published

via BleepingComputer·02:17 PM

News Published

via BleepingComputer·02:19 PM

Sep 7, 2024

CVE Published

via MITRE·04:11 PM

Data Sourced

via MITRE·04:11 PM

DescriptionSeverity

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The issue can be exploited by a low-privileged attacker. No user interaction is required, and the CVSS vector indicates it is remotely reachable over the network.

What could an attacker obtain if exploitation succeeds?

A successful authentication bypass can allow the attacker to access the NTLM hash of the service account on the VSPC server. The CVSS assessment also rates confidentiality, integrity, and availability impact as high.

CVE-2024-38650: Infoleak

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What could an attacker obtain if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What could an attacker obtain if exploitation succeeds?