CVE-2023-27532
CVE-2023-27532
In short
A flaw in Veeam Backup & Replication allows attackers to extract encrypted passwords stored in the backup system's database. With these credentials, an attacker could gain unauthorized access to the servers that manage backups.
Technical detail
CWE-306 (Missing Authentication Check) permits extraction of encrypted credentials from the configuration database in Veeam Backup & Replication. An attacker with database access or suitable privileges can decrypt stored credentials and authenticate to backup infrastructure hosts, compromising the entire backup ecosystem.
Summary generated and translated by AI from the official description.
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
n/a · Veeam Backup & Replicationpublic PoCs found — 4
githubgithub.com/sfewer-r7/CVE-2023-27532★ 114githubgithub.com/horizon3ai/CVE-2023-27532★ 73githubgithub.com/puckiestyle/CVE-2023-27532-RCE-Only★ 0githubgithub.com/yunus-a1i/veeam-cve-2023-27532-mock★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →