CVE Vulnerabilities

CVE-2024-22022

Published: Feb 07, 2024 | Modified: Feb 15, 2024

CVSS 3.x

8.8

HIGH

Source:

NVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS 2.x

RedHat/V2

RedHat/V3

Ubuntu

Additional information

NVD	https://nvd.nist.gov/vuln/detail/CVE-2024-22022
CWE	https://cwe.mitre.org/data/definitions/.html

Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash of the service account used by the Veeam Orchestrator Server Service.

Affected Software

Name	Vendor	Start Version	End Version
Recovery_orchestrator	Veeam	*	7.0 (excluding)

References

https://veeam.com/kb4541

Aqua Container Security

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.