CVE-2024-42448

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-42448", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2024-08-02T01:04:07.984Z", "datePublished": "2024-12-11T18:52:27.501Z", "dateUpdated": "2024-12-12T14:42:44.457Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine."}], "affected": [{"defaultStatus": "unaffected", "vendor": "Veeam", "product": "Service Provider Console", "versions": [{"version": "8.1", "status": "affected", "lessThanOrEqual": "8.1", "versionType": "semver"}]}], "references": [{"url": "https://www.veeam.com/kb4679"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.9, "baseSeverity": "CRITICAL"}}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2024-12-11T18:52:27.501Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-12T14:40:33.303223Z", "id": "CVE-2024-42448", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-12T14:42:44.457Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42448", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-12-12T14:40:33.303223Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-12T14:42:21.342Z"}}], "cna": {"metrics": [{"cvssV3_0": {"version": "3.0", "baseScore": 9.9, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}], "affected": [{"vendor": "Veeam", "product": "Service Provider Console", "versions": [{"status": "affected", "version": "8.1", "versionType": "semver", "lessThanOrEqual": "8.1"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.veeam.com/kb4679"}], "descriptions": [{"lang": "en", "value": "From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine."}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2024-12-11T18:52:27.501Z"}}}, "cveMetadata": {"cveId": "CVE-2024-42448", "state": "PUBLISHED", "dateUpdated": "2024-12-12T14:42:44.457Z", "dateReserved": "2024-08-02T01:04:07.984Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2024-12-11T18:52:27.501Z", "assignerShortName": "hackerone"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Service Provider Console", "vendor": "Veeam", "versions": [{"lessThanOrEqual": "8.1", "status": "affected", "version": "8.1", "versionType": "semver"}]}], "source": "support@hackerone.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine."}, {"lang": "es", "value": "Desde la m\u00e1quina del agente de administraci\u00f3n de VSPC, siempre que el agente de administraci\u00f3n est\u00e9 autorizado en el servidor, es posible realizar la ejecuci\u00f3n remota de c\u00f3digo (RCE) en la m\u00e1quina del servidor de VSPC."}], "id": "CVE-2024-42448", "lastModified": "2026-06-17T07:49:28.157", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "support@hackerone.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-42448", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-12-12T14:40:33.303223Z", "version": "2.0.3"}}]}, "published": "2024-12-12T01:59:47.493", "references": [{"source": "support@hackerone.com", "url": "https://www.veeam.com/kb4679"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"created": "2025-07-21T15:17:18.737118+00:00", "updated": "2025-07-21T15:17:18.737191+00:00", "vendors": ["veeam", "veeam$PRODUCT$service_provider_console"]}