{"id":"CVE-2024-42448","state":"PUBLISHED","title":"From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC ser","description":"From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.","publishedAt":"2024-12-11T18:52:27.501Z","updatedAt":"2024-12-12T14:42:44.457Z","severity":{"score":9.9,"label":"Critical","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"hackerone"},"assigner":"hackerone","products":["Veeam Service Provider Console"],"affected":[{"vendor":"Veeam","product":"Service Provider Console","defaultStatus":"unaffected","versions":[{"version":"8.1","status":"affected","lessThanOrEqual":"8.1","versionType":"semver"}]}],"references":["https://www.veeam.com/kb4679"],"weaknesses":["CWE-94"],"ingestedAt":"2026-10-29T20:07:47.831Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/42xxx/CVE-2024-42448.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-42448","state":"PUBLISHED","datePublished":"2024-12-11T18:52:27.501Z","dateUpdated":"2024-12-12T14:42:44.457Z","assignerShortName":"hackerone","assignerOrgId":"36234546-b8fa-4601-9d6f-f4e334aa8ea1","dateReserved":"2024-08-02T01:04:07.984Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine."}],"affected":[{"vendor":"Veeam","product":"Service Provider Console","defaultStatus":"unaffected","versions":[{"version":"8.1","status":"affected","lessThanOrEqual":"8.1","versionType":"semver"}]}],"references":[{"url":"https://www.veeam.com/kb4679"}],"metrics":[{"cvssV3_0":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL"}}],"providerMetadata":{"shortName":"hackerone","orgId":"36234546-b8fa-4601-9d6f-f4e334aa8ea1","dateUpdated":"2024-12-11T18:52:27.501Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-12-12T14:40:33.303223Z","id":"CVE-2024-42448","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-94","type":"CWE","lang":"en","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-12-12T14:42:44.457Z"}}]}}}