github - ghsa-hh3c-xpmg-w5fr

ghsa-hh3c-xpmg-w5fr

Vulnerability from github

Published

2023-03-11 00:30

Modified

2023-03-16 18:30

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.

Show details on source website

JSON

To clipboard

{
   affected: [],
   aliases: [
      "CVE-2023-27532",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-306",
      ],
      github_reviewed: false,
      github_reviewed_at: null,
      nvd_published_at: "2023-03-10T22:15:00Z",
      severity: "HIGH",
   },
   details: "Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.",
   id: "GHSA-hh3c-xpmg-w5fr",
   modified: "2023-03-16T18:30:28Z",
   published: "2023-03-11T00:30:16Z",
   references: [
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2023-27532",
      },
      {
         type: "WEB",
         url: "https://www.veeam.com/kb4424",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
         type: "CVSS_V3",
      },
   ],
}

cve-2023-27532

Vulnerability from cvelistv5

Published

2023-03-10 00:00

Modified

2025-01-28 21:28

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

▼	URL	Tags
	https://www.veeam.com/kb4424

Impacted products

	Vendor	Product	Version
	n/a	Veeam Backup & Replication	Version: Fixed Versions: v12 (build 12.0.0.1420 P20230223) Version: 11a (build 11.0.1.1261 P20230227)

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T12:16:35.584Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.veeam.com/kb4424",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  cvssV3_1: {
                     attackComplexity: "LOW",
                     attackVector: "NETWORK",
                     availabilityImpact: "NONE",
                     baseScore: 7.5,
                     baseSeverity: "HIGH",
                     confidentialityImpact: "HIGH",
                     integrityImpact: "NONE",
                     privilegesRequired: "NONE",
                     scope: "UNCHANGED",
                     userInteraction: "NONE",
                     vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                     version: "3.1",
                  },
               },
               {
                  other: {
                     content: {
                        id: "CVE-2023-27532",
                        options: [
                           {
                              Exploitation: "active",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-01-28T21:19:54.717692Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
               {
                  other: {
                     content: {
                        dateAdded: "2023-08-22",
                        reference: "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27532",
                     },
                     type: "kev",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-01-28T21:28:51.796Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "Veeam Backup & Replication",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "Fixed Versions: v12 (build 12.0.0.1420 P20230223)",
                  },
                  {
                     status: "affected",
                     version: "11a (build 11.0.1.1261 P20230227)",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-306",
                     description: "Missing Authentication for Critical Function (CWE-306)",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-10T00:00:00.000Z",
            orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
            shortName: "hackerone",
         },
         references: [
            {
               url: "https://www.veeam.com/kb4424",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
      assignerShortName: "hackerone",
      cveId: "CVE-2023-27532",
      datePublished: "2023-03-10T00:00:00.000Z",
      dateReserved: "2023-03-02T00:00:00.000Z",
      dateUpdated: "2025-01-28T21:28:51.796Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted