Stored Cross-Site Scripting Vulnerability in Acronis Cyber Protect by Acronis
CVE-2023-44207

6.7MEDIUM

Key Information:

Vendor
Acronis
Status
Acronis Cyber Protect 15
Vendor
CVE Published:
27 September 2023

Summary

A vulnerability has been identified in Acronis Cyber Protect 15 that allows for stored cross-site scripting (XSS). This security flaw occurs when user-controlled input is improperly validated, potentially enabling an attacker to inject malicious scripts. Affected versions include Acronis Cyber Protect 15 on both Linux and Windows platforms prior to build 35979. Users are advised to upgrade to the latest build to mitigate security risks.

Affected Version(s)

Acronis Cyber Protect 15 Linux < 35979

References

https://security-advisory.acronis.com/advisories/SEC-5914
vendor-advisory

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

@und3sc0n0c1d0 (https://hackerone.com/und3sc0n0c1d0)
.