#1 Global Leader in Data Resilience
#1 Global Leader in Data Resilience
BACK TO KB LIST

CVE-2023-27532

KB ID: 4424
Product: Veeam Backup & Replication
Veeam Cloud Connect
Published: 2023-03-07
Last Modified: 2024-07-29
mailbox
Get weekly article updates
By subscribing, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.
This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply except as noted in our Privacy Policy.

Cheers for trusting us with the spot in your mailbox!

Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest

error icon

Oops! Something went wrong.

Please, try again later.

Article Applicability

This article documents a vulnerability discovered in a core service of Veeam Backup & Replication and Veeam Cloud Connect.

This vulnerability does not affect other Veeam products (e.g., Veeam Backup for Microsoft 365, Veeam Agent for Microsoft Windows, Veeam ONE, Veeam Service Provider Console, etc.).

Challenge

Vulnerability CVE-2023-27532 in a Veeam Backup & Replication component allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.

Severity: High
CVSS v3 score: 7.5

Cause

The vulnerable process, Veeam.Backup.Service.exeDefault path:

C:\Program Files\Veeam\Backup and Replication\Backup\Veeam.Backup.Service.exe (TCP 9401 by default), allows an unauthenticated user to request encrypted credentials.

Solution

This vulnerability was resolved starting in the following Veeam Backup & Replication build numbers:

Notes:

  • This vulnerability affects all previous Veeam Backup & Replication versions.
  • If you use an earlier Veeam Backup & Replication version, please upgrade to a supported version first.
  • If you use an all-in-one Veeam appliance with no remote backup infrastructure components, you can alternatively block external connections to port TCP 9401 in the backup server firewall as a temporary remediation until the patch is installed.
  • The patch must be installed on the Veeam Backup & Replication server. All new deployments of Veeam Backup & Replication versions 12 and 11a installed using the ISO images dated 20230223 (V12) and 20230227 (V11a) or later are not vulnerable.

More Information

This vulnerability was reported by Shanigen.

 

Correction: This article initially listed the vulnerability ID as CVE-2023-27530, the correct vulnerability ID is CVE-2023-27532.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Spelling error in text

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply except as noted in our Privacy Policy.
Thank you!

Thank you!

Your feedback has been received and will be reviewed.

Oops! Something went wrong.

Please, try again later.

You have selected too large block!

Please try select less.

KB Feedback/Suggestion

This form is only for KB Feedback/Suggestions, if you need help with the software open a support case
By submitting, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.
This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply except as noted in our Privacy Policy.
Verify your email to continue your product download
We've sent a verification code to:
  • Incorrect verification code. Please try again.
An email with a verification code was just sent to
Didn't receive the code? Click to resend in sec
Didn't receive the code? Click to resend
Start using Veeam:
Download the product
&
Activate the license key
Thank you!

Thank you!

Your feedback has been received and will be reviewed.

error icon

Oops! Something went wrong.

Please, try again later.