« Volver al listado

CVE-2024-45206

Estado: AnalizadaMedia (6.5)—

A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Veeam — Veeam Service Provider Console

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-45206",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-45206",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-04T16:04:40.305592Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "support@hackerone.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "Veeam",
          "product": "Service Provider Console",
          "versions": [
            {
              "status": "affected",
              "version": "8.0",
              "versionType": "semver",
              "lessThanOrEqual": "8.0"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:veeam:service_provider_console:*:*:*:*:*:*:*:*"
          ],
          "vendor": "veeam",
          "product": "service_provider_console",
          "versions": [
            {
              "status": "affected",
              "version": "8.0",
              "versionType": "custom",
              "lessThanOrEqual": "8.0.0.19552"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-12-04T02:15:05.427",
  "references": [
    {
      "url": "https://www.veeam.com/kb4649",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "support@hackerone.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources."
    },
    {
      "lang": "es",
      "value": " Se ha identificado una vulnerabilidad en Veeam Service Provider Console, que permite realizar solicitudes HTTP arbitrarias a hosts arbitrarios de la red y obtener información sobre recursos internos."
    }
  ],
  "lastModified": "2026-06-17T07:53:47.747",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:veeam:veeam_service_provider_console:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50FFBB24-D779-42F4-8874-3905AA3ABF75",
              "versionEndExcluding": "8.1.0.21377",
              "versionStartIncluding": "7.0.0.12777"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "support@hackerone.com"
}