Lucene search

[email protected]CVE-2022-26504

HistoryMar 17, 2022 - 9:15 p.m.

CVE-2022-26504

2022-03-1721:15:08

CWE-287

[email protected]

web.nvd.nist.gov

cve-2022-26504

improper authentication

veeam backup & replication

arbitrary code execution

microsoft system center virtual machine manager

scvmm

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

44.6%

JSON

Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) allows attackers execute arbitrary code via Veeam.Backup.PSManager.exe

Affected configurations

NVD

Node

veeamveeam_backup_\&_replicationRange10.0.0.4442–10.0.1.4854

veeamveeam_backup_\&_replicationRange11.0.0.825–11.0.1.1261

veeamveeam_backup_\&_replicationMatch9.5.0.1536

veeamveeam_backup_\&_replicationMatch9.5.4.2615

veeamveeam_backup_\&_replicationMatch10.0.1.4854-

veeamveeam_backup_\&_replicationMatch10.0.1.4854p20201202

veeamveeam_backup_\&_replicationMatch10.0.1.4854p20210609

veeamveeam_backup_\&_replicationMatch10.0.1.4854p20220304

veeamveeam_backup_\&_replicationMatch11.0.1.1261-

veeamveeam_backup_\&_replicationMatch11.0.1.1261p20211123

veeamveeam_backup_\&_replicationMatch11.0.1.1261p20211211

veeamveeam_backup_\&_replicationMatch11.0.1.1261p20220302

CPENameOperatorVersion
veeam:veeam_backup_\&_replicationveeam veeam backup & replicationlt10.0.1.4854
veeam:veeam_backup_\&_replicationveeam veeam backup & replicationlt11.0.1.1261
veeam:veeam_backup_\&_replicationveeam veeam backup & replicationeq9.5.0.1536
veeam:veeam_backup_\&_replicationveeam veeam backup & replicationeq9.5.4.2615

CPE	Name	Operator	Version
veeam:veeam_backup_\&_replication	veeam veeam backup & replication	lt	10.0.1.4854
veeam:veeam_backup_\&_replication	veeam veeam backup & replication	lt	11.0.1.1261
veeam:veeam_backup_\&_replication	veeam veeam backup & replication	eq	9.5.0.1536
veeam:veeam_backup_\&_replication	veeam veeam backup & replication	eq	9.5.4.2615

References

veeam.com

www.veeam.com/kb4290

Social References

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

44.6%

JSON

Related for CVE-2022-26504

cvelist1 nvd1 veeam1 prion1 securelist1