CVE-2024-42455

high · 8.1

A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserialization by sending a serialized temporary file collection. This exploit allows the attacker to delete any file on the system with service account privileges. The vulnerability is caused by an insufficient blacklist during the deserialization process.

8.1

CVSS

15.2%

EPSS (exploit prob.)

97th

EPSS percentile

2024-12-04

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weaknesses

CWE-306

Affected products

Vendor	Product	Affected versions
veeam	veeam_backup_&_replication	>= 12.0.0.1402, < 12.3.0.310

Check a specific version with /api/v1/cve/match.

References

https://www.veeam.com/kb4693

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-42455