PT-2023-5779 · Acronis · Acronis Cyber Protect 15+1

Laz0Rde · Publicado 2023-09-27 · Atualizado 2023-09-28 · CVE-2023-44160

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Acronis Cyber Protect 15 versions before build 35979

Description The issue is related to sensitive information manipulation due to cross-site request forgery, which may allow a remote attacker to access confidential information. This is caused by insufficient authentication of executed requests.

Recommendations For Acronis Cyber Protect 15 versions before build 35979, update to a version that includes build 35979 or later to resolve the issue. As a temporary workaround, consider implementing additional authentication measures to minimize the risk of exploitation. Restrict access to sensitive information and functions to minimize potential damage until the update is applied.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

BDU:2023-06465

CVE-2023-44160

Produtos afetados

Acronis

Acronis Cyber Protect 15

Referências · 5

• https://security-advisory.acronis.com/advisories/SEC-4083 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-44160 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-44160 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-06465 · Nota de Segurança
• https://twitter.com/CVEnew/status/1707009495879016460 · Publicação no Twitter