Low-Privileged User Vulnerability Allows MFA Bypass
CVE-2024-40713

7.8HIGH

Key Information:

Vendor
Veeam
Status
Backup And Recovery
Vendor
CVE Published:
7 September 2024

Summary

A vulnerability exists within Veeam Backup & Replication that permits users with low-privileged roles to alter Multi-Factor Authentication (MFA) settings. This manipulation can enable these users to bypass the MFA mechanism, resulting in potential unauthorized access to critical backup and replication data. This highlights the importance of maintaining stringent access controls and regularly updating security measures to mitigate such risks.

Affected Version(s)

Backup and Recovery 12.1.2

References

https://www.veeam.com/kb4649

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.