Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSRSReport class. Due to the improper restriction of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose file contents in the context of SYSTEM. Was ZDI-CAN-10709.
CVSS Information
N/A
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Vulnerability Title
Veeam ONE 代码问题漏洞
Vulnerability Description
Veeam ONE是瑞士Veeam公司的一套IT监控和报告工具。该产品支持备份监控、虚拟和物理环境的运行状况监控等功能。 Veeam ONE 10.0.0.750_20200415版本中的SSRSReport类存在代码问题漏洞，该漏洞源于程序没有正确限制XML外部实体的引用。攻击者可借助特制文档利用该漏洞导致信息泄露。
CVSS Information
N/A
Vulnerability Type
N/A