Issue Details

CVE-2020-15418 A vulnerability in Veeam ONE Reporter that allows a remote, unauthenticated attacker to read arbitrary files through improper restriction of XML external entity (XXE) references. Severity: High CVSS v3.1 Score: 7.5CVSS: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Source: Reported by rgod through the Trend Micro Zero Day Initiative. Affected Product Veeam ONE 10.0.0.750 and all earlier version 10 builds. Veeam ONE 9.5.4.4587 and all earlier version 9.5 builds. Note: Unsupported product versions were not tested, but are likely affected and should be considered vulnerable. Solution This vulnerability was fixed starting in the following build: Veeam ONE 10a (build 10.0.2.1094)