XML external entity injection in Veeam ONE
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-611 and the CVSS impact.
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSRSReport class. Due to the improper restriction of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose file contents in the context of SYSTEM. Was ZDI-CAN-10709.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Veeam | ONE | 10.0.0.750_20200415 | — | No fix listed | CNA |
- ONE VendorVeeam Affected 10.0.0.750_20200415 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15418
- 2026-10-03 Alias added: GHSA-23f3-rj2m-g7gq
References
More Veeam One Firmware vulnerabilities
- TI-2020-12154 XML external entity injection in Veeam ONE CVSS 3.1HIGH 7.5
Sources
- CVE-2020-15418 · CVE Program
- CVE-2020-15418 · NVD
- FIRST EPSS
- GHSA-23f3-rj2m-g7gq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences