CVE-2023-38549 json
A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of…
published 2023-11-07 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-42348
- cvss
- 4.5
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 19.1%
- EPSS 19.1% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service. Note: The criticality of this vulnerability is reduced as it requires interaction by a user with the Veeam ONE Administrator role.
Patch / fix
- veeam.com/kb4508 advisory
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
19.13% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 4.5 | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected products
- Veeam One
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
veeam.com
/kb4508
patch, vendor-advisory
Sources
- CVE List CVE-2023-38549
- NVD CVE-2023-38549
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.