PT-2023-5776 · Acronis · Acronis Cyber Protect 15+1

Theelgo64 · Publicado 2023-09-27 · Atualizado 2023-09-28 · CVE-2023-44206

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Acronis Cyber Protect 15 versions before build 35979

Description The issue is related to sensitive information disclosure and manipulation due to improper authorization. It is caused by an error in processing user-controlled authorization keys, which could allow a remote attacker to elevate their privileges.

Recommendations For Acronis Cyber Protect 15 versions before build 35979, update to a version that includes the fix for this issue to prevent sensitive information disclosure and manipulation. As a temporary workaround, consider restricting access to sensitive information and authorization keys to minimize the risk of exploitation.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

BDU:2023-06462

CVE-2023-44206

Produtos afetados

Acronis

Acronis Cyber Protect 15

Referências · 5

• https://security-advisory.acronis.com/advisories/SEC-5839 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-44206 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1707009490350907586 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-44206 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-06462 · Nota de Segurança