PT-2022-16473 · Acronis · Acronis Cyber Protect Home Office+4

Penrose · Published 2022-02-02 · Updated 2022-02-11 · CVE-2022-24113

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Acronis Cyber Protect 15 (Windows) versions before build 28035 Acronis Agent (Windows) versions before build 27147 Acronis Cyber Protect Home Office (Windows) versions before build 39612 Acronis True Image 2021 (Windows) versions before build 39287

Description The issue is related to local privilege escalation due to excessive permissions assigned to child processes.

Recommendations For Acronis Cyber Protect 15 (Windows) versions before build 28035, update to build 28035 or later. For Acronis Agent (Windows) versions before build 27147, update to build 27147 or later. For Acronis Cyber Protect Home Office (Windows) versions before build 39612, update to build 39612 or later. For Acronis True Image 2021 (Windows) versions before build 39287, update to build 39287 or later.

Fix

LPE

Incorrect Default Permissions

Weakness Enumeration

CWE-276

CWE-250

Related Identifiers

CVE-2022-24113

Affected Products

Acronis

Acronis Agent

Acronis Cyber Protect 15

Acronis Cyber Protect Home Office

Acronis True Image 2021

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-24113 · Security Note
• https://security-advisory.acronis.com/advisories/SEC-2881 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24113 · Vendor Advisory
• https://t.me/cvenotify/26621 · Telegram Post