ZDI-CAN-24589: ZDI-24-1472: Veeam Backup Enterprise Manager AuthorizeByVMwareSsoToken Improper Certificate Validation Authentication Bypass Vulnerability
Published Nov 12, 2024
·Updated
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Veeam Backup Enterprise Manager. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.0. The following CVEs are assigned: CVE-2024-40715.
Affected Software
1 affected component
Veeam Backup Enterprise Manager
Event History
Nov 12, 2024
Advisory Published
via ZDI·06:00 AM
Data Sourced
via ZDI·06:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-CAN-24589?
The severity of ZDI-CAN-24589 is rated at 5.0 on the CVSS scale.
2
How do I fix ZDI-CAN-24589?
To fix ZDI-CAN-24589, ensure your installation of Veeam Backup Enterprise Manager is updated to the latest security patch.
3
Who can exploit ZDI-CAN-24589?
Network-adjacent attackers can exploit ZDI-CAN-24589 without requiring authentication.
4
What type of attack does ZDI-CAN-24589 enable?
ZDI-CAN-24589 allows attackers to bypass authentication on affected installations.
5
Which software is affected by ZDI-CAN-24589?
ZDI-CAN-24589 affects Veeam Backup Enterprise Manager installations.