Arbitrary File Overwrite Vulnerability in Acronis Backup Plugins for cPanel, Plesk, and DirectAdmin
CVE-2024-34014
Key Information:
- Vendor
- Acronis
- Status
- Vendor
- CVE Published:
- 11 November 2024
Summary
An arbitrary file overwrite vulnerability exists in the Acronis Backup plugins for cPanel, Plesk, and DirectAdmin due to improper handling of symbolic links. This vulnerability may allow unauthorized users to overwrite files on the server, leading to potential data loss or corruption. Affected products include the Acronis Backup plugin for cPanel & WHM (Linux) prior to build 818, the Acronis Backup extension for Plesk (Linux) prior to build 599, and the Acronis Backup plugin for DirectAdmin (Linux) prior to build 181. Users are urged to apply the latest updates to mitigate risks.
Affected Version(s)
Acronis Backup extension for Plesk Linux < 1.8.6.599
Acronis Backup plugin for cPanel & WHM Linux < 1.8.3.818
Acronis Backup plugin for cPanel & WHM Linux < 1.9.1.892
References
CVSS V3.0
Timeline
Vulnerability published