How severe is CVE-2024-42455?

This vulnerability has a severity rating of HIGH with a CVSS score of 7.1 out of 10.

What type of vulnerability is CVE-2024-42455?

This is classified as CWE-306, which is a common weakness in software security.

CVE-2024-42455 - HIGH Severity | CVSS 7.1

Vulnerability Description

A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserialization by sending a serialized temporary file collection. This exploit allows the attacker to delete any file on the system with service account privileges. The vulnerability is caused by an insufficient blacklist during the deserialization process.

Related Vulnerabilities

CVE-2020-10124

HIGH

CVSS:7.1(High)

NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host computer, which could allow an attacker with physical access...

CWE-3062020

CVE-2020-35226

HIGH

CVSS:7.1(High)

NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allow unauthenticated users to modify the switch DHCP configuration by sending the corresponding write request command.

CWE-3062020

CVE-2020-36125

HIGH

CVSS:7.1(High)

Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control where password revalidation in sensitive operations can be bypassed remotely by an authenticated attacke...

CWE-3062020

CVE-2023-30643

HIGH

CVSS:7.1(High)

Missing authentication vulnerability in Galaxy Themes Service prior to SMR Jul-2023 Release 1 allows local attackers to delete arbitrary non-preloaded applications.

CWE-3062023

CVE-2023-5881

HIGH

CVSS:7.1(High)

Unauthenticated access permitted to web interface page The Genie Company Aladdin Connect (Retrofit-Kit Model ALDCM) "Garage Door Control Module Setup" and modify the Garage door's SSID settings.

CWE-3062023

CVE-2024-5951

HIGH

CVSS:7.1(High)

Deep Sea Electronics DSE855 Factory Reset Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installation...

CWE-3062024