PT-2022-20438 · Acronis · Acronis Agent+2

Published 2022-05-18 · Updated 2023-07-21 · CVE-2022-30990

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Acronis Cyber Protect 15 (Linux) versions before build 29240 Acronis Agent (Linux) versions before build 28037

Description The issue is related to sensitive information disclosure due to insecure folder permissions.

Recommendations For Acronis Cyber Protect 15 (Linux) versions before build 29240, update to build 29240 or later. For Acronis Agent (Linux) versions before build 28037, update to build 28037 or later.

Fix

Information Disclosure

Incorrect Permission

Weakness Enumeration

CWE-200

CWE-732

Related Identifiers

CVE-2022-30990

Affected Products

Acronis

Acronis Agent

Acronis Cyber Protect 15

References · 7

• https://osv.dev/vulnerability/CVE-2022-30990 · Vendor Advisory
• https://security-advisory.acronis.com/advisories/SEC-2299 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30990 · Security Note
• https://t.me/cvenotify/30979 · Telegram Post
• https://t.me/cvenotify/30407 · Telegram Post
• https://t.me/cvenotify/30417 · Telegram Post
• https://t.me/cibsecurity/42965 · Telegram Post