CVE-2024-29849

—

CVSS 3.0

9.8 critical

EPSS

38%p98

Published

May 22, 2024 (May 22, 2024)

Modified

Jun 17, 2026

Description

Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.

Vendors: veeam
Products: veeam backup \& replication
Weakness: CWE-287
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (38.4%)

In the news5 stories

Veeam fixes auth bypass flaw in Backup Enterprise Manager (CVE-2024-29849)

Help Net SecurityJun 13, 21:18 UTC · Jun 13, 2024Vulnerability in the wildCVE-2024-29849 CVE-2024-29850 CVE-2024-29851+1 CVEs

60

Expert released PoC exploit code for Veeam Backup Enterprise Manager flaw CVE-2024

Security AffairsJun 11, 09:19 UTC · Jun 11, 2024Exploit / PoC in the wildCVE-2024-29849

60

Week in review: Google fixes yet another Chrome zero-day exploit, YouTube as a cybercrime channel

Help Net SecurityMay 26, 00:00 UTC · May 26, 2024Exploit / PoC in the wildCVE-2024-5274 CVE-2024-4985 CVE-2023-43208+4 CVEs

60

Critical Veeam Backup Enterprise Manager auth bypass bug

Security AffairsMay 22, 18:01 UTC · May 22, 2024Vulnerability CVE-2024-29849 CVE-2024-29850 CVE-2024-29851+1 CVEs

60

Critical Veeam Backup Enterprise Manager Flaw Allows Authentication Bypass

The Hacker NewsMay 22, 03:53 UTC · May 22, 2024Vulnerability CVE-2024-29849 CVE-2024-29850 CVE-2024-29851+4 CVEs

60