CVE-2024-42456
First published: Wed Dec 04 2024(Updated: )
A vulnerability in Veeam Backup & Replication platform allows a low-privileged user with a specific role to exploit a method that updates critical configuration settings, such as modifying the trusted client certificate used for authentication on a specific port. This can result in unauthorized access, enabling the user to call privileged methods and initiate critical services. The issue arises due to insufficient permission requirements on the method, allowing users with low privileges to perform actions that should require higher-level permissions.
Credit: support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Veeam | ||
| Veeam Backup & Replication | >=12.0.0.1402<12.3.0.310 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-42456?
CVE-2024-42456 is considered a critical vulnerability due to the potential for unauthorized access to sensitive configuration settings.
How do I fix CVE-2024-42456?
To fix CVE-2024-42456, update to the latest version of Veeam Backup & Replication that addresses this vulnerability.
Who is affected by CVE-2024-42456?
Veeam Backup & Replication users with low-privileged roles may be affected by CVE-2024-42456.
What kind of attack does CVE-2024-42456 enable?
CVE-2024-42456 allows an attacker to modify critical configuration settings, potentially allowing unauthorized users to access the system.
When was CVE-2024-42456 disclosed?
CVE-2024-42456 was disclosed in 2024, highlighting the vulnerabilities in specific methods within Veeam Backup & Replication.
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/severity
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- vendor/veeam
- canonical/veeam
- canonical/veeam backup & replication
- version/veeam backup & replication/12.0.0.1402