9.3
CriticalCVSS 4.0 · from hackerone
CVE-2023-22793
A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft…
Management Pack for Microsoft System Center · Unsafe deserialization · CWE-502AffectedManagement Pack for Microsoft System Center
FixUpdate to 13.1.0.334 or newer
PublishedOct 29, 22:55 · hackerone
ScoredOct 29 · 9.3 · hackerone
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:07 UTC
What we know
No known exploitation. CISA KEV, checked 22:07 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.
From hackerone
Affected and fixed versions
ProductAffectedFixed inManagement Pack for Microsoft System Center9.0 – before 13.1.0.33413.1.0.334
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known