{"id":"CVE-2024-40717","published":"2024-12-04T01:06:04Z","modified":"2025-03-13T17:40:27Z","title":"A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code…","vendor":"Veeam","product":"Backup & Replication","tier":"tail","description":{"text":"A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by updating existing jobs. These jobs can be configured to run pre- and post-scripts, which can be located on a network share and are executed with elevated privileges by default. The user can update a job and schedule it to run almost immediately, allowing arbitrary code execution on the server.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00759,"percentile":0.55107,"provenance":"source"},"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"https://www.veeam.com/kb4693","tags":[]}],"priority":{"score":17.2,"factors":[{"name":"EPSS percentile","points":11.02},{"name":"CVSS severity","points":6.16}]},"vendorSlug":"veeam","affectedVersions":[{"vendor":"Veeam","product":"Backup & Replication","versions":[">= 12.2, <= 12.2"]}],"euvd":{"id":"EUVD-2024-38805","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-class-veeam-backup-replication-cwe-306"}}