CVE-2023-38547 in the critical feed json
A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access it…
published 2023-11-07 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-42346
- cvss
- 9.9
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 20.7%
- EPSS 20.7% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database. This may lead to remote code execution on the SQL server hosting the Veeam ONE configuration database.
Patch / fix
- veeam.com/kb4508 advisory
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 20 mo ago
Exploit prediction
20.67% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 9.9 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Veeam One
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
veeam.com
/kb4508
patch, vendor-advisory
Sources
- CVE List CVE-2023-38547
- NVD CVE-2023-38547
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.