PT-2023-5789 · Acronis · Acronis Cyber Protect 15+1

Published 2023-09-27 · Updated 2024-09-10 · CVE-2023-44152

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Acronis Cyber Protect 15 versions prior to build 35979

Description The issue is related to the lack of an authentication procedure, which can be exploited by a remote attacker to elevate their privileges. This can lead to the disclosure and manipulation of sensitive information.

Recommendations For Acronis Cyber Protect 15 versions prior to build 35979, update to a version that includes build 35979 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information and implementing additional authentication measures until a patch is applied.

Fix

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

BDU:2023-06475

CVE-2023-44152

Affected Products

Acronis

Acronis Cyber Protect 15

References · 6

• https://osv.dev/vulnerability/CVE-2023-44152 · Vendor Advisory
• https://security-advisory.acronis.com/advisories/SEC-1908 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-44152 · Security Note
• https://bdu.fstec.ru/vul/2023-06475 · Security Note
• https://t.me/cvenotify/94023 · Telegram Post
• https://twitter.com/CVEnew/status/1707009502749303007 · Twitter Post