TRY NOW
book meeting
BACK TO KB LIST

CVE-2023-38547 | CVE-2023-38548 

CVE-2023-38549 | CVE-2023-41723

KB ID: 4508
Product: Veeam ONE | 11 | 12
Veeam Recovery Orchestrator | 6.0
Veeam Disaster Recovery Orchestrator | 5.0
Veeam Availability Orchestrator | 4.0
Published: 2023-11-06
Last Modified: 2026-10-29
mailbox
Get weekly article updates
By subscribing, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.

Cheers for trusting us with the spot in your mailbox!

Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest

error icon

Oops! Something went wrong.

Please, try again later.

Veeam ONE 12.1 is not affected by the vulnerabilities discussed on this page. 

Additionally, Veeam Recovery Orchestrator 7 is not affected by these vulnerabilities as it uses Veeam ONE 12.1.

Issue Details

CVE-2023-38547

A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database. This may lead to remote code execution on the SQL server hosting the Veeam ONE configuration database.

Affected Version(s)*: Veeam ONE 11, 11a, 12
Severity: Critical
CVSS v3.1: 9.9

 

CVE-2023-38548

A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service.

Affected Version(s)*: Veeam ONE 12
Severity: Critical
CVSS v3.1 score:  9.8

 

CVE-2023-38549

A vulnerability in Veeam ONE allows a user with the Veeam ONE Power User role to obtain the access token of a user with the Veeam ONE Administrator role through the use of XSS.
Note: The criticality of this vulnerability is reduced as it requires interaction by a user with the Veeam ONE Administrator role.

Affected Version(s)*: Veeam ONE 11, 11a, 12
Severity: Medium
CVSS v3.1 score: 4.5

 

CVE-2023-41723

A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule.
Note: The criticality of this vulnerability is reduced because the user with the Read-Only role is only able to view the schedule and cannot make changes.

Affected Version(s)*: Veeam ONE 11, 11a, 12
Severity: Medium
CVSS v3.1 score: 4.3

 

*Vulnerability testing was only performed using actively supported versions of Veeam ONE.

Solution

At the time a hotfix to resolve these vulnerabilities was made available for the following versions:

  • Veeam ONE 12 P20230314 (12.0.1.2591)
  • Veeam ONE 11a (11.0.1.1880)
  • Veeam ONE 11 (11.0.0.1379)

 

These vulnerabilities were resolved starting in release Veeam ONE 12.1 12.1.0.3208.

More Information

The vulnerabilities associated with CVE-2023-38547, CVE-2023-38548, and CVE-2023-38549 were reported by Jarmo Puttonen(@putsi).

 

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Spelling error in text

Thank you!

Thank you!

Your feedback has been received and will be reviewed.

Oops! Something went wrong.

Please, try again later.

You have selected too large block!

Please try select less.

KB Feedback/Suggestion

This form is only for KB Feedback/Suggestions, if you need help with the software open a support case
By submitting, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.
Verify your email to continue your product download
We've sent a verification code to:
  • Incorrect verification code. Please try again.
An email with a verification code was just sent to
Didn't receive the code? Click to resend in sec
Didn't receive the code? Click to resend
Start using Veeam:
Download the product
&
Activate the license key
Thank you!

Thank you!

Your feedback has been received and will be reviewed.

error icon

Oops! Something went wrong.

Please, try again later.