CVE-2024-39714: Code Injection

Published Sep 7, 2024

Updated

A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution on VSPC server.

Affected Software

1 affected component

Veeam Veeam Service Provider Console

Event History

Sep 5, 2024

News Published

via BleepingComputer·02:17 PM

News Published

via BleepingComputer·02:19 PM

Sep 7, 2024

CVE Published

via MITRE·04:11 PM

Data Sourced

via MITRE·04:11 PM

DescriptionSeverity

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker needs a low-privileged user account in Veeam Service Provider Console. The vulnerability is remotely reachable and does not require user interaction.

What is the potential impact of a successful exploit?

A low-privileged user can upload arbitrary files to the server, which can lead to remote code execution on the VSPC server. The provided CVSS vector indicates high impact to confidentiality, integrity, and availability, with scope change.

Are unauthenticated attackers affected?

The CVSS vector specifies low privileges required (PR:L), so the provided data does not indicate that unauthenticated exploitation is possible.

CVE-2024-39714: Code Injection

Affected Software

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What is the potential impact of a successful exploit?

Are unauthenticated attackers affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What is the potential impact of a successful exploit?

Are unauthenticated attackers affected?