8.8Alta
KEV
Usada en ransomware
CVE-2022-26500Veeam Backup & Replication Remote Code Execution Vulnerability
Explotación conocida — Veeam Backup & Replication Remote Code Execution Vulnerability
CISA confirmó el 13.12.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 03.01.2023.
Acción requerida: Apply updates per vendor instructions. https://www.veeam.com/kb4288; https://nvd.nist.gov/vuln/detail/CVE-2022-26500
Descripción
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.
Debilidad (CWE):
CWE-22
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| veeam | veeam backup & replication | 10.0.0.4442 – < 10.0.1.4854 |
Referencias y parches
- https://veeam.com Vendor Advisory
- https://www.veeam.com/kb4288 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26500 US Government Resource
Coincidencias CPE (NVD) (10)
cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:*≥ 10.0.0.4442 < 10.0.1.4854cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:*≥ 11.0.0.825 < 11.0.1.1261cpe:2.3:a:veeam:veeam_backup_\&_replication:9.5.0.1536:*:*:*:*:*:*:*cpe:2.3:a:veeam:veeam_backup_\&_replication:9.5.4.2615:*:*:*:*:*:*:*cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:-:*:*:*:*:*:*cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:p20201202:*:*:*:*:*:*cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:p20210609:*:*:*:*:*:*cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:-:*:*:*:*:*:*cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20211123:*:*:*:*:*:*cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20211211:*:*:*:*:*:*