CVE-2024-45204 Information disclosure in Backup & Replication
A low-privileged user can leak NTLM hashes of saved credentials due to insufficient permissions, potentially enabling broader security breaches.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-45204?
CVE-2024-45204 is a high-severity vulnerability in Veeam Backup & Replication, published on 4 Dec 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability exists where a low-privileged user can exploit insufficient permissions in credential handling to leak NTLM hashes of saved credentials. The exploitation involves using retrieved credentials to expose sensitive NTLM hashes, impacting systems beyond the initial target and potentially leading to broader security vulnerabilities.
Weakness: CWE-863
Which versions are affected by CVE-2024-45204?
It affects 1 product.
Products include Veeam Veeam Backup \& Replication.
How do I fix CVE-2024-45204?
No fix has been published for CVE-2024-45204 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-45204 being exploited?
There is no known exploitation of CVE-2024-45204 in the wild and no public exploit code.
Other vulnerabilities in Veeam Backup & Replication
- CVE-2024-40711 Veeam Backup and Replication Deserialization
- CVE-2022-26501 Veeam Backup & Replication Remote Code Execution
- CVE-2022-26500 Veeam Backup & Replication Remote Code Execution
- CVE-2023-27532 Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function
- CVE-2026-21666 Missing authorization in Backup and Replication
Sources
Also known as GHSA-2m43-qgqq-69c7.