CVE-2024-29855

2024-06-1104:15:12

hackerone

web.nvd.nist.gov

cve-2024-29855

hard-coded jwt secret

authentication bypass

veeam recovery orchestrator

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

7.2

Confidence

Low

EPSS

Percentile

9.0%

JSON

Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator

Affected configurations

Vulners

Vulnrichment

Node

veeamrecovery_orchestratorRange<7.1.0.230

veeamrecovery_orchestratorRange<7.0.0.379

VendorProductVersionCPE
veeamrecovery_orchestrator*cpe:2.3:a:veeam:recovery_orchestrator:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
veeam	recovery_orchestrator	*	cpe:2.3:a:veeam:recovery_orchestrator::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Veeam",
    "product": "Recovery Orchestrator",
    "versions": [
      {
        "version": "7.1.0.230",
        "status": "affected",
        "lessThan": "7.1.0.230",
        "versionType": "semver"
      },
      {
        "version": "7.0.0.379",
        "status": "affected",
        "lessThan": "7.0.0.379",
        "versionType": "semver"
      }
    ]
  }
]