Security News > 2024 > May > Veeam warns of critical Backup Enterprise Manager auth bypass bug
VBEM is a web-based platform that enables administrators to manage Veeam Backup & Replication installations via a single web console.
It's important to note that VBEM isn't enabled by default, and not all environments are susceptible to attacks exploiting the CVE-2024-29849 vulnerability, which Veeam has rated with a CVSS base score of 9.8/10. "This vulnerability in Veeam Backup Enterprise Manager allows an unauthenticated attacker to log in to the Veeam Backup Enterprise Manager web interface as any user," the company explains.
If not currently in use, Veeam Backup Enterprise Manager can also be uninstalled using these instructions to remove the attack vector.
Today, Veeam also patched two high-severity VBEM vulnerabilities, one that allows account takeover via NTLM relay and a second one that enables high-privileged users to steal the Veeam Backup Enterprise Manager service account's NTLM hash if it's not configured to run as the default Local System account.
In March 2023, Veeam patched a high-severity vulnerability in the Backup & Replication software that could be exploited to breach backup infrastructure hosts.
GitHub warns of SAML auth bypass flaw in Enterprise Server.
News URL
Related news
- Exploit code for critical GitLab auth bypass flaw released (CVE-2024-45409) (source)
- Akira and Fog ransomware now exploit critical Veeam RCE flaw (source)
- Critical Veeam Vulnerability Exploited to Spread Akira and Fog Ransomware (source)
- Critical Veeam RCE bug now used in Frag ransomware attacks (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-05-22 | CVE-2024-29849 | Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface. | 0.0 |