CVE-2024-22021
Assigner: hackerone
Published: 2024-02-07T00:53:30.493Z
State: PUBLISHED
descriptions: value: Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retrieve plans from a Scope other than the one they are assigned to. 

affected: vendor: Veeam
product: Recovery Orchestrator 
versions: version: 6
status: affected
lessThan: 6
versionType: semver
vendor: Veeam
product: Disaster Recovery Orchestrator
versions: version: 5
status: affected
lessThan: 5
versionType: semver
vendor: Veeam
product: Availability Orchestrator
versions: version: 4
status: affected
lessThan: 4
versionType: semver
vendor: Veeam
product: Recovery Orchestrator
versions: version: 7
status: unaffected
lessThan: 7
versionType: semver
metrics: cvssV3_0: version: 3.0
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
baseScore: 6.5
baseSeverity: MEDIUM