Veeam Recovery Orchestrator Vulnerability
( CVE-2024-22021 |  CVE-2024-22022 )

CVE-2024-22021

Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retrieve plans from a Scope other than the one they are assigned to.

Affected Version(s)*:

• Veeam Recovery Orchestrator 6
• Veeam Disaster Recovery Orchestrator 5
• Veeam Availability Orchestrator 4

Severity: Medium
CVSS v3.1 Score: 4.5

 CVE-2024-22022

Vulnerability  CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash of the service account used by the Veeam Orchestrator Server Service.

Affected Version(s)*:

• Veeam Recovery Orchestrator 6
• Veeam Disaster Recovery Orchestrator 5
• Veeam Availability Orchestrator 4

Severity: High
CVSS v3.1 Score: 8.8

*Vulnerability testing was only performed using actively supported versions of Veeam Recovery Orchestrator.

Veeam strongly recommends that customers use the most recent version of the software. However, we understand some environments may require additional planning and time to deploy an upgrade. In recognition of this, a patch has been developed for Veeam Recovery Orchestrator 6 that resolves the vulnerabilities discussed in this article. We encourage affected users who are unable to upgrade to Veeam Recovery Orchestrator 7 to apply this patch as soon as possible to maintain system security.

• Customers running Veeam Recovery Orchestrator 6 may either:
  • Upgrade to Veeam Recovery Orchestrator 7. (Recommended)
    
    or
  • Install the vulnerability resolution patch. (Details below)
• Customers running Veeam Disaster Recovery Orchestrator 5 must upgrade to Veeam Recovery Orchestrator 6, then review the options available for that version.
• Customers running Veeam Availability Orchestrator 4 must upgrade to Veeam Disaster Recovery Orchestrator 5 and then review the options available for that version.