CVE-2024-39718

2024-09-0717:15:12

hackerone

web.nvd.nist.gov

improper input validation

low-privileged user

remote file removal

service account permissions

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

Percentile

9.5%

JSON

An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account.

Affected configurations

Vulners

Node

veeambackup_and_recoveryRange≤12.1.2

VendorProductVersionCPE
veeambackup_and_recovery*cpe:2.3:a:veeam:backup_and_recovery:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
veeam	backup_and_recovery	*	cpe:2.3:a:veeam:backup_and_recovery::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Veeam",
    "product": "Backup and Recovery",
    "versions": [
      {
        "version": "12.1.2",
        "status": "affected",
        "lessThanOrEqual": "12.1.2",
        "versionType": "semver"
      }
    ]
  }
]