CVE-2024-40712

2024-09-0717:15:13

CWE-22

hackerone

web.nvd.nist.gov

path traversal

local privilege escalation

vulnerability

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

Percentile

11.1%

JSON

A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE).

Affected configurations

Vulners

Vulnrichment

Node

veeambackup_and_recoveryRange≤12.1.2

VendorProductVersionCPE
veeambackup_and_recovery*cpe:2.3:a:veeam:backup_and_recovery:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
veeam	backup_and_recovery	*	cpe:2.3:a:veeam:backup_and_recovery::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Veeam",
    "product": "Backup and Recovery",
    "versions": [
      {
        "version": "12.1.2",
        "status": "affected",
        "lessThanOrEqual": "12.1.2",
        "versionType": "semver"
      }
    ]
  }
]