Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Veeam Service Provider Console allows unauthorized network access

CVE-2024-45206 · published 1 year ago
Summary

A security weakness in Veeam Service Provider Console could allow hackers to access internal network resources and gather sensitive information. This is a concern for organizations that use Veeam for backup and management tasks. To protect your network, update to the latest version of Veeam Service Provider Console as soon as possible.

What to do
  • Update veeam veeam_service_provider_console to version 8.1.0.21377 or later.
Affected software
VendorProductAffected versions
veeam veeam_service_provider_console >= 7.0.0.12777, < 8.1.0.21377
cpe:2.3:a:veeam:veeam_service_provider_console:*:*:*:*:*:*:*:*
Original advisory text
A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources.
A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published4 Dec 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-45206 · NVD
CVE-2024-45206 · OSV
Track software like this
Free during beta