PT-2023-5779 · Acronis · Acronis Cyber Protect 15+1

Laz0Rde · Published 2023-09-27 · Updated 2023-09-28 · CVE-2023-44160

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Acronis Cyber Protect 15 versions before build 35979

Description The issue is related to sensitive information manipulation due to cross-site request forgery, which may allow a remote attacker to access confidential information. This is caused by insufficient authentication of executed requests.

Recommendations For Acronis Cyber Protect 15 versions before build 35979, update to a version that includes build 35979 or later to resolve the issue. As a temporary workaround, consider implementing additional authentication measures to minimize the risk of exploitation. Restrict access to sensitive information and functions to minimize potential damage until the update is applied.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2023-06465

CVE-2023-44160

Affected Products

Acronis

Acronis Cyber Protect 15

References · 5

• https://security-advisory.acronis.com/advisories/SEC-4083 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-44160 · Security Note
• https://osv.dev/vulnerability/CVE-2023-44160 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06465 · Security Note
• https://twitter.com/CVEnew/status/1707009495879016460 · Twitter Post