Veeam ONE is susceptible to a SQL injection vulnerability that permits unauthorized database access by low-privileged users.

This vulnerability, identified as CWE-89, involves improper neutralization of special elements used in an SQL command. It allows a low-privileged authenticated user to manipulate database queries to exfiltrate data.

The ability to extract database contents presents a severe risk of data breach and unauthorized disclosure of sensitive monitoring information. Given the CVSS score of 8.6, this vulnerability could be leveraged to gain deep insight into the internal environment, potentially aiding further lateral movement.

Immediate Action: Consult the Veeam Knowledge Base (KB4892) and apply the latest security updates provided by the vendor.

Proactive Monitoring: Monitor database query logs for unusual patterns, such as unexpected syntax or large data retrieval requests originating from standard user accounts.

Compensating Controls: Implement a Web Application Firewall or database firewall to filter malicious SQL syntax, and restrict database permissions for non-administrative accounts.

Public Exploit Available: No

Organizations using Veeam ONE should verify their current version and apply patches as soon as they are made available by Veeam. Given the high potential for data exfiltration, ensuring that all security updates are applied is critical to protecting the confidentiality of the monitored environment.