Lucene search

HackeroneCVE-2024-42021

HistorySep 07, 2024 - 5:15 p.m.

CVE-2024-42021

2024-09-0717:15:14

CWE-284

hackerone

web.nvd.nist.gov

improper access control

saved credentials

vulnerability

CVSS3

7.5

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

AI Score

6.8

Confidence

Low

EPSS

Percentile

9.5%

JSON

An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials.

Affected configurations

Vulners

Vulnrichment

Node

veeamoneRange≤12.1

VendorProductVersionCPE
veeamone*cpe:2.3:a:veeam:one:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
veeam	one	*	cpe:2.3:a:veeam:one::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Veeam",
    "product": "One",
    "versions": [
      {
        "version": "12.1",
        "status": "affected",
        "lessThanOrEqual": "12.1",
        "versionType": "semver"
      }
    ]
  }
]

References

www.veeam.com/kb4649

Social References

CVSS3

7.5

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

AI Score

6.8

Confidence

Low

EPSS

Percentile

9.5%

JSON

Related for CVE-2024-42021