PT-2023-5776 · Acronis · Acronis Cyber Protect 15+1

Theelgo64 · Published 2023-09-27 · Updated 2023-09-28 · CVE-2023-44206

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Acronis Cyber Protect 15 versions before build 35979

Description The issue is related to sensitive information disclosure and manipulation due to improper authorization. It is caused by an error in processing user-controlled authorization keys, which could allow a remote attacker to elevate their privileges.

Recommendations For Acronis Cyber Protect 15 versions before build 35979, update to a version that includes the fix for this issue to prevent sensitive information disclosure and manipulation. As a temporary workaround, consider restricting access to sensitive information and authorization keys to minimize the risk of exploitation.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BDU:2023-06462

CVE-2023-44206

Affected Products

Acronis

Acronis Cyber Protect 15

References · 5

• https://security-advisory.acronis.com/advisories/SEC-5839 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-44206 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-44206 · Security Note
• https://bdu.fstec.ru/vul/2023-06462 · Security Note
• https://twitter.com/CVEnew/status/1707009490350907586 · Twitter Post