Veeam Releases Security Update
The security update addresses the vulnerability CVE-2023-27532, which affects the Veeam Backup & Replication Component
Summary
The security update addresses the vulnerability CVE-2023-27532, which affects the Veeam Backup & Replication Component
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
CVE-2023-27532 is a high severity vulnerability with a CVSSv3 score of 7.5 affecting Veeam's Backup & Replication component. It allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. Exploitation of this vulnerability could allow an unauthenticated attacker to gain access to the backup infrastructure hosts.
There are reports of exploitation of CVE-2023-27532 in the wild.
Exploitation of CVE-2023-27532 in the wild
A proof-of-concept (PoC) has been publicly released for CVE-2023-27532 and exploitation in the wild has been reported.
Threat updates
| Date | Update |
|---|---|
| 3 May 2023 |
Exploitation of CVE-2023-27532 in the wild
This cyber alert has been updated to reflect this change |
| 24 Mar 2023 |
Proof-of-concept released for CVE-2023-27532
This cyber alert has been updated to reflect this change. |
Remediation advice
Affected organisations are encouraged to review the Veeam Security Bulletin and apply the relevant updates.
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 3 May 2023 2:49 pm