Description (CNA)
A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by updating existing jobs. These jobs can be configured to run pre- and post-scripts, which can be located on a network share and are executed with elevated privileges by default. The user can update a job and schedule it to run almost immediately, allowing arbitrary code execution on the server.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Veeam / Backup & Replication | affected 12.2 through 12.2 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No references supplied.