PT-2023-4681 · Acronis · Acronis Cyber Protect 15+2

Published 2023-08-31 · Updated 2023-09-06 · CVE-2023-41745

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Acronis Agent versions prior to build 30991 Acronis Cyber Protect 15 versions prior to build 35979

Description The issue is related to sensitive information disclosure due to excessive collection of system information. This is caused by insufficient protection of service data, which may allow an attacker to gain unauthorized access to protected information.

Recommendations For Acronis Agent versions prior to build 30991, update to build 30991 or later to resolve the issue. For Acronis Cyber Protect 15 versions prior to build 35979, update to build 35979 or later to resolve the issue.

Fix

Exposure of Resource to Wrong Sphere

Information Disclosure

Weakness Enumeration

CWE-668

CWE-200

Related Identifiers

BDU:2023-05097

CVE-2023-41745

Affected Products

Acronis

Acronis Agent

Acronis Cyber Protect 15

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-41745 · Security Note
• https://security-advisory.acronis.com/advisories/SEC-2008 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-41745 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05097 · Security Note
• https://vuldb.com/ru/?id.238521 · Note
• https://t.me/cibsecurity/69587 · Telegram Post