The version of Veeam Backup and Replication installed on the remote Windows host is 12.x prior to 12.3.0.310. It is, therefore, affected by multiple vulnerabilities, including:

  - A vulnerability allows an authenticated user with a role assigned in the Users and Roles settings on the     backup server to execute a script with elevated privileges by configuring it as a pre-job or post-job     task, thereby causing the script to be executed as LocalSystem. (RCE). (CVE-2024-40717)

  - A vulnerability allows an authenticated user with a role assigned in the Users and Roles settings on the     backup server to access all saved credentials in a human-readable format. (CVE-2024-42452)

  - A vulnerability that allows an authenticated user with a role assigned in the Users and Roles settings on     the backup server to gain access to privileged methods and control critical services. (CVE-2024-42456)

Note that Nessus has not tested for this issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Veeam Backup and Replication 12.x < 12.3.0.310 Multiple Vulnerabilities (December 2024) (KB4693)

high Nessus Plugin ID 212090

Version 1.5