Read the docs
TI-2024-28420 Aliases CVE-2024-42451GHSA-w345-4xm5-q2xp

Cleartext storage of sensitive information in Veeam Backup & Replication

Priority LOW 29CWE-312Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-312 and CWE-863.

Summary

A vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved credentials in plaintext. This is achieved by calling a series of methods over an external protocol, ultimately retrieving the credentials using a malicious setup on the attacker's side. This exposes sensitive data, which could be used for further attacks, including unauthorized access to systems managed by the platform.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00279 20th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
VeeamBackup & Replication12.2 – 12.2—No fix listedCNA
  • Backup & Replication VendorVeeam Affected 12.2 – 12.2 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:*12.0.0.1402 to before 12.3.0.310VulnerableVeeam
  • cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:* Versions 12.0.0.1402 to before 12.3.0.310 Vulnerable ·Veeam

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-42451
  2. 2026-10-03 Alias added: GHSA-w345-4xm5-q2xp

References

Advisory 1

  • TI-2024-27107 Deserialization of untrusted data in Veeam Backup and Recovery KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-09844 Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2). KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-09843 Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and… KEVCVSS 3.1HIGH 8.8
  • TI-2023-12256 Missing authentication in Veeam Backup & Replication KEVCVSS 3.1HIGH 7.5
  • TI-2024-19623 Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface. CVSS 3.0CRITICAL 9.8
  • TI-2025-16913 A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user CVSS 3.1HIGH 8.8
See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences