Cyber Resilience

CVE-2023-41723

Medium

Published: 07 November 2023

Published
07 November 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0144 81.1th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-41723 is a medium-severity Insecure Storage of Sensitive Information (CWE-922) vulnerability in Veeam One. Its CVSS base score is 4.3 (Medium).

Operationally, ranked in the top 18.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule. Note: The criticality of this vulnerability is reduced because the user with the Read-Only role is only able to view…

more

the schedule and cannot make changes.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

veeam
one
11.0.0.1379, 11.0.1.1880, 12.0.0.2498, 12.0.1.2591

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-922

Tracking information locations and access supports secure storage practices instead of insecure ones.

addresses: CWE-922

Establishing an alternate site with equivalent protections directly mitigates insecure storage of sensitive backup information.

addresses: CWE-922

Requiring protection of backup information directly addresses insecure storage of sensitive data in backups.

addresses: CWE-922

Policy explicitly addresses insecure storage of CUI on external systems, requiring compliant handling and protections.

addresses: CWE-922

Proper categorization drives selection of storage controls that keep sensitive information from being stored insecurely.

addresses: CWE-922

The control explicitly requires secure storage mechanisms for sensitive information, closing the insecure-storage weakness class.

addresses: CWE-922

Storing information as fragments on distinct components is an architectural control that avoids insecure single-location storage of the complete sensitive data set.

addresses: CWE-922

OPSEC requirements improve handling and storage practices for sensitive supply-chain information.

References