Stored Cross-Site Scripting Vulnerability in Acronis Cyber Protect 16
CVE-2024-55541

Currently unrated

Key Information:

Vendor
Acronis
Status
Acronis Cyber Protect 16
Vendor
CVE Published:
2 January 2025

Summary

A stored cross-site scripting (XSS) vulnerability exists in Acronis Cyber Protect 16 due to insufficient origin validation in the postMessage function. This flaw allows attackers to inject malicious scripts that could be executed in the context of the affected application. Users operating versions prior to build 39169 are particularly at risk. Mitigation efforts are recommended to address this vulnerability and safeguard sensitive user data. For further information, consult the vendor's advisory.

Affected Version(s)

Acronis Cyber Protect 16 Linux < 39169

References

https://security-advisory.acronis.com/advisories/SEC-3647
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.