CVE-2022-26500

HIGHCISA KEV

8.8

Beschreibung

Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.

CVE Details

CVSS v3.1 Bewertung8.8

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht3/17/2022

Zuletzt geandert11/3/2025

Quellekev

Honeypot-Sichtungen0

CISA KEV

HerstellerVeeam

ProduktBackup & Replication

SchwachstellennameVeeam Backup & Replication Remote Code Execution Vulnerability

KEV Aufnahmedatum2022-12-13

Behebungsfrist2023-01-03

Ransomware-NutzungKnown

Betroffene Produkte

veeam:veeam_backup_\&_replication

Schwachen (CWE)

CWE-22CWE-22

Referenzen

https://veeam.com(cve@mitre.org)

https://www.veeam.com/kb4288(cve@mitre.org)

https://veeam.com(af854a3a-2127-422b-91ae-364da2661108)

https://www.veeam.com/kb4288(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26500(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.