Veeam Sicherheitslücke - CVE-2023-27532

Subject: Veeam Backup & Replication vulnerability
Hello [Name],
 
We are writing to inform you that a vulnerability has been discovered within a Veeam® Backup & Replication™ component that could allow an unauthenticated user request encrypted credentials that could lead to them gaining access to backup infrastructure hosts. This affects all Veeam Backup & Replication versions.

We have developed patches for V11 and V12 to mitigate this vulnerability and we recommend you update your installations immediately. You can access the patches and instructions at https://www.veeam.com/kb4424. If you are not the current manager of your Veeam environment, please forward this email to the proper person. If you use an all-in-one Veeam appliance with no remote backup infrastructure components, you can also block external connections to port TCP 9401 in the backup server firewall as a temporary remediation until the patch is installed.

Veeam has a long-standing commitment to ensuring our products protect customers from any potential risk. As part of this, we run a Vulnerability Disclosure Program (VDP) for all our products. In mid-February, a security researcher identified and reported this vulnerability for Veeam Backup & Replication v11 and v12 with a CVSS score of 7.5, indicating high severity. We immediately reviewed and confirmed the vulnerability and developed an update that resolves the issue.

If you have any questions, don’t hesitate to contact Veeam support: https://my.veeam.com/#/open-case/step-1

Thank you,
Veeam Customer Support