High severity · published Apr 26, 2024
CVE-2024-33671
An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391
7.1
CVSS
0.2%
EPSS
No
On KEV
Description
An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. The Backup Exec Deduplication Multi-threaded Streaming Agent can be leveraged to perform arbitrary file deletion on protected files.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BE
Backup Exec · Veritas
21.0 before 23.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-33671
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-33671
Vendor Advisory
https://www.veritas.com/support/en_US/security/VTS24-002#H1
More from Backup Exec
9.8
CVE-2021-27877
Veritas Backup Exec Agent Improper Authentication Vulnerability
8.8
CVE-2021-27878
Veritas Backup Exec Agent Command Execution Vulnerability
8.1
CVE-2021-27876
Veritas Backup Exec Agent File Access Vulnerability
9.8
CVE-2017-8895
In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in multiple agents that can…
8.8
CVE-2020-36167
An issue was discovered in the server in Veritas Backup Exec through 16.2, 20.6 before hotfix 298543, and 21.1 before hotfix 657517