KB4934: Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2 P4

Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest

Oops! Something went wrong. Please, try again later.

Oops! Something went wrong.

Please, try again later.

All vulnerabilities listed in this article:

Affect only Veeam Backup & Replication 12.3.2 P3 (build 12.3.2.4854) and older builds.

Are resolved in Veeam Backup & Replication 12.3.2 P4 (build 12.3.2.4934).

Do not affect any Veeam Backup & Replication version 13 builds.

Customers are reminded that Veeam Backup & Replication version 12 will reach End of Support on 2027-02-28.

A vulnerability allowing a low-privileged user with the Backup Viewer role to perform remote code execution (RCE) on the Veeam Backup Server through insecure deserialization of untrusted data received via the Mount Service.

Severity: Critical CVSS v4.0 Score: 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Source: Reported through HackerOne.

Veeam Backup & Replication 12.3.2.4854 and all earlier version 12 builds . Note: Version 13 is not affected.

This vulnerability was fixed starting in the following build:

Veeam Backup & Replication 12.3.2 P4 (build 12.3.2.4934)

A vulnerability allowing an authenticated user with the Backup Viewer role to modify or delete the Enterprise Manager master key and read or overwrite stored antivirus update credentials on the Veeam Backup Server.

Severity: Medium CVSS v4.0 Score: 6.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N Source: Reported through HackerOne.

Veeam Backup & Replication 12.3.2.4854 and all earlier version 12 builds . Note: Version 13 is not affected.

This vulnerability was fixed starting in the following build:

Veeam Backup & Replication 12.3.2 P4 (build 12.3.2.4934)

A reflected cross-site scripting vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of an authenticated portal user who opens a crafted link.

Severity: Medium CVSS v4.0 Score: 4.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N Source: Reported through HackerOne.

Veeam Backup Enterprise Manager (Veeam Backup & Replication) 12.3.2.4854 and all earlier version 12 builds . Note: Version 13 is not affected.

This vulnerability was fixed starting in the following build:

Veeam Backup & Replication 12.3.2 P4 (build 12.3.2.4934)

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Spelling error in text

Your feedback has been received and will be reviewed.

Oops! Something went wrong.

Please, try again later.

You have selected too large block!

Please try select less .

KB Feedback/Suggestion

This form is only for KB Feedback/Suggestions, if you need help with the software open a support case

Your feedback has been received and will be reviewed.

Oops! Something went wrong. Please, try again later.

Oops! Something went wrong.

Please, try again later.