CVE-2024-40714

2024-09-0717:15:13

CWE-295

hackerone

web.nvd.nist.gov

improper certificate validation

sensitive data interception

tls certificate

CVSS3

8.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

6.7

Confidence

High

EPSS

Percentile

9.5%

JSON

An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations.

Affected configurations

Vulners

Vulnrichment

Node

veeambackup_and_recoveryRange≤12.1.2

VendorProductVersionCPE
veeambackup_and_recovery*cpe:2.3:a:veeam:backup_and_recovery:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
veeam	backup_and_recovery	*	cpe:2.3:a:veeam:backup_and_recovery::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Veeam",
    "product": "Backup and Recovery",
    "versions": [
      {
        "version": "12.1.2",
        "status": "affected",
        "lessThanOrEqual": "12.1.2",
        "versionType": "semver"
      }
    ]
  }
]