« Volver al listado

CVE-2024-38650

Estado: AplazadaCrítica (9.9)—

An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Vmware — VspcAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-38650",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-38650",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-09T13:14:42.800022Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "support@hackerone.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "Veeam",
          "product": "Veeam Service Provider Console",
          "versions": [
            {
              "status": "affected",
              "version": "8",
              "versionType": "semver",
              "lessThanOrEqual": "8"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:veeam:service_provider_console:*:*:*:*:*:*:*:*"
          ],
          "vendor": "veeam",
          "product": "service_provider_console",
          "versions": [
            {
              "status": "affected",
              "version": "8",
              "versionType": "semver",
              "lessThanOrEqual": "8.0.0.19552"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-09-07T17:15:12.183",
  "references": [
    {
      "url": "https://www.veeam.com/kb4649",
      "source": "support@hackerone.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de omisión de autenticación puede permitir que un atacante con pocos privilegios acceda al hash NTLM de la cuenta de servicio en el servidor VSPC."
    }
  ],
  "lastModified": "2026-06-17T07:40:48.063",
  "sourceIdentifier": "support@hackerone.com"
}