CVE-2024-42449: High severity Veeam Service Provider Console vulnerability
Published Dec 4, 2024
·Updated
From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to remove arbitrary files on the VSPC server machine.
Affected Software
1 affected component
Veeam Service Provider Console
Event History
Dec 3, 2024
News Published
via BleepingComputer·06:07 PM
News Published
via BleepingComputer·06:08 PM
Dec 4, 2024
CVE Published
via MITRE·01:06 AM
Data Sourced
via MITRE·01:06 AM
DescriptionSeverity
Data Sourced
via NVD·02:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The attacker needs access from a VSPC management agent machine and that management agent must already be authorized on the VSPC server. No user interaction is required.
2
What is the impact on the VSPC server?
An attacker meeting the authorization condition can remove arbitrary files on the VSPC server machine. This can affect integrity and availability.