A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST…
A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Veeam
- Product
- Backup for Microsoft 365
- CVSS v4.0
- 6.9 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Weakness
- CWE-347
- Exposure class
- Collaboration, Backup
- NVD status
- Received
Why it ranks 23 (Routine)
- CVSS v4.0 6.9 medium
- Exposed product class: backup
- Widely deployed vendor product (Veeam)
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.