ZDI-24-1472: Veeam Backup Enterprise Manager AuthorizeByVMwareSsoToken Improper Certificate Validation Authentication Bypass Vulnerability
Published Nov 12, 2024
·Updated
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Veeam Backup Enterprise Manager. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.0. The following CVEs are assigned: CVE-2024-40715.
Affected Software
1 affected component
Veeam Backup Enterprise Manager
Event History
Nov 12, 2024
Advisory Published
via ZDI·06:00 AM
Data Sourced
via ZDI·06:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-24-1472?
The severity of ZDI-24-1472 is rated at 5.0 on the CVSS scale.
2
How do I fix ZDI-24-1472?
To fix ZDI-24-1472, update your Veeam Backup Enterprise Manager to the latest version provided by the vendor.
3
What type of attack does ZDI-24-1472 enable?
ZDI-24-1472 enables network-adjacent attackers to bypass authentication without needing any valid credentials.
4
Which software is affected by ZDI-24-1472?
ZDI-24-1472 affects Veeam Backup Enterprise Manager installations.
5
Is authentication required to exploit ZDI-24-1472?
No, authentication is not required to exploit ZDI-24-1472.