CVEvulnerability
CVE-2023-38549
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-11-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 3.0 ([email protected])
- 4.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-79
Description
A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service. Note: The criticality of this vulnerability is reduced as it requires interaction by a user with the Veeam ONE Administrator role.
Affected configurations
• veeam one 11.0.0.1379
• veeam one 11.0.1.1880
• veeam one 12.0.0.2498
• veeam one 12.0.1.2591
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://www.veeam.com/kb4508 Patch, Vendor Advisory
- https://www.veeam.com/kb4508 Patch, Vendor Advisory