PT-2022-20443 · Acronis · Acronis Cyber Backup 12.5+2

Boldglum + 1 · Published 2022-11-17 · Updated 2023-05-09 · CVE-2022-30995

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Acronis Cyber Protect 15 versions before build 29486 Acronis Cyber Backup 12.5 versions before build 16545

Description The issue is related to sensitive information disclosure due to improper authentication.

Recommendations For Acronis Cyber Protect 15 versions before build 29486, update to build 29486 or later. For Acronis Cyber Backup 12.5 versions before build 16545, update to build 16545 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2022-30995

Affected Products

Acronis

Acronis Cyber Backup 12.5

Acronis Cyber Protect 15

References · 5

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/acronis_cyber_protect_machine_info_disclosure.rb · Exploit
• https://osv.dev/vulnerability/CVE-2022-30995 · Vendor Advisory
• https://security-advisory.acronis.com/advisories/SEC-3855 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30995 · Security Note
• https://t.me/cibsecurity/63208 · Telegram Post