Lucene search

Veeam softwareVEEAM:KB4575

HistoryMay 07, 2024 - 12:00 a.m.

Veeam Service Provider Console Vulnerability ( CVE-2024-29212 )

2024-05-0700:00:00

Veeam software

www.veeam.com

veeam

service provider console

vulnerability

cve-2024-29212

unsafe deserialization

remote code execution

rce

software

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

Due to an unsafe deserialization method used by the Veeam Service Provider Console (VSPC) server in communication between the management agent and its components, under certain conditions, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.

CPENameOperatorVersion
veeam service provider consoleeq8.0
veeam service provider consoleeq7.0
veeam service provider consoleeq6.0
veeam service provider consoleeq5.0
veeam service provider consoleeq4.0

Name	Operator	Version
veeam service provider console	eq	8.0
veeam service provider console	eq	7.0
veeam service provider console	eq	6.0
veeam service provider console	eq	5.0
veeam service provider console	eq	4.0

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

Related for VEEAM:KB4575