Lucene search

MitreCVE-2022-26503

HistoryMar 17, 2022 - 5:15 p.m.

CVE-2022-26503

2022-03-1717:15:07

CWE-502

mitre

web.nvd.nist.gov

143

cve

2022

26503

veeam agent

windows

deserialization

vulnerability

local users

arbitrary code

local system privileges

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

Percentile

12.7%

JSON

Deserialization of untrusted data in Veeam Agent for Windows 2.0, 2.1, 2.2, 3.0.2, 4.x, and 5.x allows local users to run arbitrary code with local system privileges.

Affected configurations

Nvd

Node

veeamveeamRange4.0.0–4.0.2.2208

veeamveeamRange5.0.0–5.0.3.4708

veeamveeamMatch2.0

veeamveeamMatch2.1

veeamveeamMatch2.2

veeamveeamMatch3.0.2

AND

microsoftwindowsMatch-

VendorProductVersionCPE
veeamveeam*cpe:2.3:a:veeam:veeam:*:*:*:*:*:*:*:*
veeamveeam2.0cpe:2.3:a:veeam:veeam:2.0:*:*:*:*:*:*:*
veeamveeam2.1cpe:2.3:a:veeam:veeam:2.1:*:*:*:*:*:*:*
veeamveeam2.2cpe:2.3:a:veeam:veeam:2.2:*:*:*:*:*:*:*
veeamveeam3.0.2cpe:2.3:a:veeam:veeam:3.0.2:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
veeam	veeam	*	cpe:2.3:a:veeam:veeam::::::::
veeam	veeam	2.0	cpe:2.3:a:veeam:veeam:2.0:::::::*
veeam	veeam	2.1	cpe:2.3:a:veeam:veeam:2.1:::::::*
veeam	veeam	2.2	cpe:2.3:a:veeam:veeam:2.2:::::::*
veeam	veeam	3.0.2	cpe:2.3:a:veeam:veeam:3.0.2:::::::*
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*

References

veeam.com

www.veeam.com/kb4289

Social References

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

Percentile

12.7%

JSON

Related for CVE-2022-26503