CVE-2024-45206
MEDIUMCVSS 6.5/10EPSS 0.24%
Last modified
CVE-2024-45206 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources.. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources.
Metrics
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Veeam | Veeam Service Provider Console | >= 7.0.0.12777, < 8.1.0.21377 |
References
- https://www.veeam.com/kb4649Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-45206?
A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources.
How severe is CVE-2024-45206?
CVE-2024-45206 has a CVSS score of 6.5/10 (MEDIUM severity). The EPSS model estimates a 0.24% probability of exploitation in the next 30 days.
How do I fix CVE-2024-45206?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-4520An improper access control vulnerability exists in the gaizh…7.5
- CVE-2024-45200In Nintendo Mario Kart 8 Deluxe before 3.0.3, the LAN/LDN lo…6.3
- CVE-2024-45201An issue was discovered in llama_index before 0.10.38. downl…8.8
- CVE-2024-45203Improper authorization in handler for custom URL scheme issu…4.3
- CVE-2024-45204A vulnerability exists where a low-privileged user can explo…4.3
- CVE-2024-45205An Improper Certificate Validation on the UniFi iOS App mana…7.1
- CVE-2024-45207DLL injection in Veeam Agent for Windows can occur if the sy…7
- CVE-2024-45208The Versa Director SD-WAN orchestration platform which makes…9.8
- CVE-2024-4521A vulnerability classified as problematic has been found in …6.1
- CVE-2024-45216Improper Authentication vulnerability in Apache Solr. Solr …9.8
- CVE-2024-45217Insecure Default Initialization of Resource vulnerability in…8.1
- CVE-2024-45219Account users in Apache CloudStack by default are allowed to…8.5
Are you affected by CVE-2024-45206?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST