CVE-2024-40712

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE).

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Veeam	Backup and Recovery	>= 12.1.2, <= 12.1.2
veeam	backup_\&_replication	>= 12, <= 12.1.2.172

References

https://www.veeam.com/kb4649Vendor Advisory

Timeline

Published: Sep 7, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-407137.8A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authe CVE-2024-407148.3An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive CVE-2024-407157.7A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypas CVE-2024-407178.8A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by upda CVE-2024-407188.8A server side request forgery vulnerability allows a low-privileged user to perform local privilege escalation through exploiting an SSRF vu CVE-2024-407196.5The encryption strength of the authorization keys in CHANGING Information Technology TCBServiSign Windows Version is insufficient. When a re CVE-2024-40725.4A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. It has been classified as problematic. Affected is a CVE-2024-407208.8The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a u CVE-2024-407218.8The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a u CVE-2024-407224.3The specific API in TCBServiSign Windows Version from CHANGING Information Technology does does not properly validate the length of server-s CVE-2024-407234.3The specific API in HWATAIServiSign Windows Version from CHANGING Information Technology does not properly validate the length of server-sid CVE-2024-407247.8Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a