PT-2022-6627 · Acronis · Acronis Agent+2

Netero1010 · Published 2022-11-16 · Updated 2023-05-26 · CVE-2022-45452

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Acronis Agent versions before build 30430 Acronis Cyber Protect 15 versions before build 30984

Description The issue is related to local privilege escalation due to insecure folder permissions. This can allow an attacker to elevate their privileges.

Recommendations For Acronis Agent versions before build 30430, update to build 30430 or later. For Acronis Cyber Protect 15 versions before build 30984, update to build 30984 or later.

Fix

LPE

Improper Privilege Management

Incorrect Default Permissions

Weakness Enumeration

CWE-269

CWE-276

Related Identifiers

BDU:2023-02884

CVE-2022-45452

Affected Products

Acronis

Acronis Agent

Acronis Cyber Protect 15

References · 6

• https://osv.dev/vulnerability/CVE-2022-45452 · Vendor Advisory
• https://security-advisory.acronis.com/advisories/SEC-3967 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02884 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-45452 · Security Note
• https://vuldb.com/ru/?id.229357 · Note
• https://t.me/cibsecurity/64388 · Telegram Post