Pierluigi Paganini
November 07, 2023
Veeam addressed four vulnerabilities (CVE-2023-38547, CVE-2023-38548, CVE-2023-38549, CVE-2023-41723) in the Veeam ONE IT infrastructure monitoring and analytics platform.
The vulnerability CVE-2023-38547 (CVSS score 9.9) can be exploited by an unauthenticated attacker to gain information about the SQL server connection Veeam ONE uses to access its configuration database.
“A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database.” . “This may lead to remote code execution on the SQL server hosting the Veeam ONE configuration database.”
Affected Version(s) are Veeam ONE 11, 11a, 12..
The second critical flaw, tracked as CVE-2023-38548 (CVSS score 9.8), can be exploited by an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service.
The vulnerability only affects Veeam ONE 12.
The remaining vulnerabilities, tracked as CVE-2023-38549 and CVE-2023-41723, are medium-severity flaws.
The vulnerability CVE-2023-38549 (CVSS score: 4.5) allows a user with the role to obtain the access token of a user with the role by carrying out an XSS attack.
The last vulnerability, tracked as CVE-2023-41723 (CVSS score: 4.3), can be exploited by a user with the role to view the .
The issue affects Veeam ONE versions 11, 11a, 12
In March, Veeam addressed a high-severity flaw, tracked as , in Veeam Backup and Replication (VBR) software. An unauthenticated user with access to the Veeam backup service (TCP 9401 by default) can exploit the flaw to request cleartext credentials.
A remote attacker can exploit the flaw to access the backup systems of a target organization and execute arbitrary code as ‘SYSTEM.’
After the public disclosure of the vulnerability, the researchers at Horizon3’s Attack Team published technical details for this vulnerability along with a .
Follow me on Twitter: and and Mastodon
(SecurityAffairs – hacking, Veeam ONE)
