Authentication Bypass in Veeam ONE Web Client by Veeam

CVE-2023-38549

Summary

A security vulnerability in Veeam ONE Web Client allows an unprivileged user to retrieve the NTLM hash from the account used by the Veeam ONE Reporting Service. Although the risk is mitigated by the requirement for a user with the Veeam ONE Administrator role to initiate the action, it still poses a significant security concern. This vulnerability highlights the need for robust user access controls and auditing mechanisms within Veeam ONE implementations.

References