Lucene search

HackeroneCVE-2024-42022

HistorySep 07, 2024 - 5:15 p.m.

CVE-2024-42022

2024-09-0717:15:14

CWE-284

hackerone

web.nvd.nist.gov

incorrect permission assignment

modify configuration

attacker vulnerability

CVSS3

7.5

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

AI Score

6.8

Confidence

Low

EPSS

Percentile

9.5%

JSON

An incorrect permission assignment vulnerability allows an attacker to modify product configuration files.

Affected configurations

Vulners

Vulnrichment

Node

veeamoneRange≤12.1

VendorProductVersionCPE
veeamone*cpe:2.3:a:veeam:one:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
veeam	one	*	cpe:2.3:a:veeam:one::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Veeam",
    "product": "One",
    "versions": [
      {
        "version": "12.1",
        "status": "affected",
        "lessThanOrEqual": "12.1",
        "versionType": "semver"
      }
    ]
  }
]

References

www.veeam.com/kb4649

Social References

CVSS3

7.5

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

AI Score

6.8

Confidence

Low

EPSS

Percentile

9.5%

JSON

Related for CVE-2024-42022