PT-2023-5314 · Acronis · Acronis Agent

Published 2023-08-31 · Updated 2023-09-06 · CVE-2023-41751

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Acronis Agent versions prior to build 32047

Description The issue is related to insufficient authentication procedure in the backup and recovery software, which may allow an attacker to access confidential information. Specifically, it involves improper token expiration validation, potentially leading to sensitive information disclosure.

Recommendations For Acronis Agent versions prior to build 32047, update to a version that includes the fix for the improper token expiration validation issue, specifically build 32047 or later. As a temporary workaround, consider restricting access to sensitive information and ensuring that all authentication procedures are thoroughly reviewed and validated to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2023-05940

CVE-2023-41751

Affected Products

Acronis Agent

References · 6

• https://bdu.fstec.ru/vul/2023-05940 · Security Note
• https://security-advisory.acronis.com/advisories/SEC-5615 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41751 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41751 · Vendor Advisory
• https://vuldb.com/ru/?id.238528 · Note
• https://t.me/cibsecurity/69596 · Telegram Post