What it is about

Proxmox Backup Server ist eine Enterprise-Backup-Lösung zur Sicherung und Wiederherstellung von VMs, Containern und physischen Hosts. Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Proxmox Backup Server ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen und um einen Denial of Service herbeizuführen.

Under what conditions?

Over the network, but only with valid access (login required), for example with stolen credentials or as an insider.

What can happen in the worst case

An attacker could use the vulnerability to

• Sicherheitsvorkehrungen zu umgehen
• Informationen offenzulegen
• einen Denial of Service herbeizuführen

Am I affected?

Affected according to the BSI:

• Proxmox Backup Server <4.2.8-1

The installed version is usually shown under “Help → About” or in the device’s admin interface.

What helps?

Update to at least:

• Proxmox Backup Server 4.2.8-1

Is the vulnerability already being exploited?

None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.