CVE-2024-42021: 
Veeam ONE vulnerability analysis and mitigation

CVE-2024-42021 is a high-severity vulnerability affecting Veeam ONE versions 12.1.0.3208 and earlier. The vulnerability was discovered and reported through HackerOne in September 2024. This security flaw allows attackers with valid access tokens to access saved credentials within the Veeam ONE system (Veeam KB).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. This scoring indicates that the vulnerability requires local access, high complexity to exploit, and high privileges, but requires no user interaction. The scope is changed, and successful exploitation could lead to high impacts on confidentiality, integrity, and availability (Veeam KB, Security Online).

If successfully exploited, the vulnerability allows attackers with valid access tokens to gain unauthorized access to saved credentials stored within the Veeam ONE system. This could potentially lead to further compromise of the system and exposure of sensitive information (Security Online).

Veeam has addressed this vulnerability in Veeam ONE v12.2 (build 12.2.0.4093). Organizations using affected versions are strongly urged to upgrade to the latest version as there are no alternative workarounds available. The vendor emphasizes that once vulnerabilities are disclosed, attackers may attempt to reverse-engineer patches to exploit unpatched systems (Veeam KB).