CVE-2022-43549

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper authentication in Veeam Backup for Google Cloud v1.0 and v3.0 allows attackers to bypass authentication mechanisms.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

VendorProductVersions
n/aVeeam Backup for Google Cloud1.0, 3.0

References

Timeline

Published
Dec 5, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-43557.2The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading CVE-2022-435509.8A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows CVE-2022-435517.5A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can beCVE-2022-435525.9A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proCVE-2022-435538.8A remote code execution vulnerability in EdgeRouters (Version 2.0.9-hotfix.4 and earlier) allows a malicious actor with an operator account CVE-2022-435547.8Ivanti Avalanche Smart Device Service Missing Authentication Local Privilege Escalation VulnerabilityCVE-2022-435557.8Ivanti Avalanche Printer Device Service Missing Authentication Local Privilege Escalation VulnerabilityCVE-2022-435566.1Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dasCVE-2022-435575.3The BD BodyGuard™ infusion pumps specified allow for access through the RS-232 (serial) port interface. If exploited, threat actors with phyCVE-2022-43567.2The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading CVE-2022-435614.8In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user that holds the “power” Splunk role can store arbitrary scripts tCVE-2022-435625.4In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, Splunk Enterprise fails to properly validate and escape the Host header, which
CVE-2022-43549: Critical severity, CVSS 9.8 | Vulnix