Paper/Archive/CVE-2023-38547

CVE-2023-38547

Veeam One — A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access…

EPSS 19%CVSS 9.9

critical.is priorityof 100

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 97.3.973 × 2019.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database. This may lead to remote code execution on the SQL server hosting the Veeam ONE configuration database.

Affected

ProductAffectedFixed inSource

One11 – 11–CNA

One11a – 11a–CNA

One12 – 12–CNA

Scores by source

hackerone (CNA)9.9CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refveeam.com/kb4508