PT-2023-9003 · Acronis · Acronis Cyber Protect Cloud Agent

Published 2023-12-14 · Updated 2023-12-19 · CVE-2023-48676

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Acronis Cyber Protect Cloud Agent (Windows) versions before build 36943

Description The issue is related to sensitive information disclosure and manipulation due to missing authorization. This could allow an attacker to gain unauthorized access to protected information.

Recommendations For Acronis Cyber Protect Cloud Agent (Windows) versions before build 36943, update to a version that includes build 36943 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information until the update can be applied.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2024-02952

CVE-2023-48676

Affected Products

Acronis Cyber Protect Cloud Agent

References · 8

• https://security-advisory.acronis.com/advisories/SEC-5905 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48676 · Security Note
• https://osv.dev/vulnerability/CVE-2023-48676 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02952 · Security Note
• https://twitter.com/VulmonFeeds/status/1735325891130012040 · Twitter Post
• https://t.me/cvenotify/64139 · Telegram Post
• https://twitter.com/CVEnew/status/1735293271214022791 · Twitter Post
• https://t.me/cvenotify/63708 · Telegram Post