CVE-2023-38548 in the critical feed json
A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of…
published 2023-11-07 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-42347
- cvss
- 9.8
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 11.7%
- EPSS 11.7% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service.
Patch / fix
- veeam.com/kb4508 advisory
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 20 mo ago
Exploit prediction
11.66% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected products
- Veeam One
Classification
- Weakness
-
- CWE-522 Insufficiently Protected Credentials
References
-
veeam.com
/kb4508
patch, vendor-advisory
Sources
- CVE List CVE-2023-38548
- NVD CVE-2023-38548
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.