Sensitive Information Disclosure in Acronis Cyber Protect by Acronis
CVE-2023-44206

7.1HIGH

Key Information:

Vendor
Acronis
Status
Acronis Cyber Protect 15
Vendor
CVE Published:
27 September 2023

Summary

A vulnerability has been identified in Acronis Cyber Protect 15 that allows for sensitive information disclosure and manipulation due to improper authorization mechanisms. This issue affects both Linux and Windows versions prior to build 35979. Organizations utilizing these affected builds should apply necessary patches to mitigate risks associated with unauthorized access to sensitive data.

Affected Version(s)

Acronis Cyber Protect 15 Linux < 35979

References

https://security-advisory.acronis.com/advisories/SEC-5839
vendor-advisory

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

@theelgo64 (https://hackerone.com/theelgo64)
.