Pierluigi Paganini November 07, 2023

Veeam addressed multiple vulnerabilities in its Veeam ONE IT infrastructure monitoring and analytics platform, including two critical issues.

Veeam addressed four vulnerabilities (CVE-2023-38547, CVE-2023-38548, CVE-2023-38549, CVE-2023-41723) in the Veeam ONE IT infrastructure monitoring and analytics platform.

The vulnerability CVE-2023-38547 (CVSS score 9.9) can be exploited by an unauthenticated attacker to gain information about the SQL server connection Veeam ONE uses to access its configuration database.

“A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database.” reads the advisory. “This may lead to remote code execution on the SQL server hosting the Veeam ONE configuration database.”

Affected Version(s) are Veeam ONE 11, 11a, 12..

The second critical flaw, tracked as CVE-2023-38548 (CVSS score 9.8), can be exploited by an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service.

The vulnerability only affects Veeam ONE 12.

The remaining vulnerabilities, tracked as CVE-2023-38549 and CVE-2023-41723, are medium-severity flaws.

The vulnerability CVE-2023-38549 (CVSS score: 4.5) allows a user with the Veeam ONE Power User role to obtain the access token of a user with the Veeam ONE Administrator role by carrying out an XSS attack.

The last vulnerability, tracked as CVE-2023-41723 (CVSS score: 4.3), can be exploited by a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule.
The issue affects Veeam ONE versions 11, 11a, 12

In March, Veeam addressed a high-severity flaw, tracked as CVE-2023-27532, in Veeam Backup and Replication (VBR) software. An unauthenticated user with access to the Veeam backup service (TCP 9401 by default) can exploit the flaw to request cleartext credentials.

A remote attacker can exploit the flaw to access the backup systems of a target organization and execute arbitrary code as ‘SYSTEM.’

After the public disclosure of the vulnerability, the researchers at Horizon3’s Attack Team published technical details for this vulnerability along with a PoC exploit code.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Veeam ONE)