VEEAM: CVE-2023-38547 | CVE-2023-38548 | CVE-2023-38549 | CVE-2023-41723


Veeam ONE has multiple vulnerabilities (CVE-2023-38547, CVE-2023-38548, CVE-2023-38549, CVE-2023-41723) that allow unauthorized access, information disclosure, and potential remote code execution. The affected versions are Veeam ONE 11, 11a, and 12.

  • Vulnerabilities in Veeam ONE pose significant risks, including remote code execution and unauthorized access.
  • CVE-2023-38547 exposes SQL server connection information, leading to potential remote code execution.
  • CVE-2023-38548 allows unprivileged users to acquire the NTLM hash of the Veeam ONE Reporting Service account.
  • CVE-2023-38549 enables obtaining the access token of a Veeam ONE Administrator through XSS, though it requires user interaction.
  • CVE-2023-41723 allows Read-Only Users to view the Dashboard Schedule but not make changes.
  • The severity of some vulnerabilities is reduced due to specific limitations or required user roles.
  • Affected versions include Veeam ONE 11, 11a, and 12.

Source:
https://www.veeam.com/kb4508