PT-2023-5799 · Acronis · Acronis Cyber Protect 16+2

Published 2023-10-06 · Updated 2024-02-27 · CVE-2023-45244

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Acronis Cyber Protect Cloud Agent versions prior to build 35895 Acronis Cyber Protect 16 versions prior to build 37391 Acronis Agent versions prior to build 35895

Description The issue is related to errors in authorization, which may allow an attacker to elevate their privileges. This can lead to sensitive information disclosure and manipulation due to missing authorization.

Recommendations For Acronis Cyber Protect Cloud Agent versions prior to build 35895, update to build 35895 or later. For Acronis Cyber Protect 16 versions prior to build 37391, update to build 37391 or later. For Acronis Agent versions prior to build 35895, update to build 35895 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2023-06485

CVE-2023-45244

Affected Products

Acronis Agent

Acronis Cyber Protect 16

Acronis Cyber Protect Cloud Agent

References · 8

• https://bdu.fstec.ru/vul/2023-06485 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-45244 · Security Note
• https://security-advisory.acronis.com/advisories/SEC-5907 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-45244 · Vendor Advisory
• https://twitter.com/CVEnew/status/1710237614840652251 · Twitter Post
• https://t.me/cvenotify/72459 · Telegram Post
• https://t.me/cibsecurity/71703 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1710271788549087324 · Twitter Post