Medium severity · published Nov 7, 2023
CVE-2023-38549
A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE…
5.4
CVSS
19.1%
EPSS
No
On KEV
Description
A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service. Note: The criticality of this vulnerability is reduced as it requires interaction by a user with the Veeam ONE Administrator role.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)19.1% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ON
One · Veeam
11.0.0.1379; 11.0.1.1880; 12.0.0.2498; 12.0.1.2591 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-38549
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-38549
Patch
https://www.veeam.com/kb4508
More from One
10.0
CVE-2026-64633
A vulnerability allowing remote unauthenticated code execution on the agent host
9.8
CVE-2023-38547
A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database
9.8
CVE-2020-10915
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587
9.8
CVE-2020-10914
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587
9.3
CVE-2026-65641
A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account