PT-2023-5796 · Acronis · Acronis Cyber Protect 16+2

Published 2023-10-05 · Updated 2024-02-27 · CVE-2023-44211

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Acronis Cyber Protect Cloud Agent versions prior to build 31637 Acronis Cyber Protect 16 versions prior to build 37391 Acronis Agent versions prior to the specified build

Description The issue is related to errors in authorization, which can allow an attacker to elevate their privileges. This can lead to the disclosure and manipulation of sensitive information due to missing authorization.

Recommendations For Acronis Cyber Protect Cloud Agent versions prior to build 31637, update to build 31637 or later. For Acronis Cyber Protect 16 versions prior to build 37391, update to build 37391 or later. For Acronis Agent versions prior to the specified build, update to the latest version that includes the necessary security fixes.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2023-06482

CVE-2023-44211

Affected Products

Acronis Agent

Acronis Cyber Protect 16

Acronis Cyber Protect Cloud Agent

References · 7

• https://security-advisory.acronis.com/advisories/SEC-4061 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06482 · Security Note
• https://osv.dev/vulnerability/CVE-2023-44211 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-44211 · Security Note
• https://twitter.com/VulmonFeeds/status/1710092407469961286 · Twitter Post
• https://twitter.com/CVEnew/status/1710043402644119748 · Twitter Post
• https://t.me/cvenotify/72456 · Telegram Post