PT-2024-13623 · Acronis · Acronis Cyber Protect 16

Und3Sc0N0C1D0 · Published 2024-02-27 · Updated 2024-02-28 · CVE-2023-48682

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Acronis Cyber Protect 16 versions prior to build 37391

Description A stored cross-site scripting (XSS) vulnerability exists in the unit name, allowing for potential exploitation. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations For Acronis Cyber Protect 16 versions prior to build 37391, update to a version after build 37391 to resolve the issue. As a temporary workaround, consider restricting access to the unit name field to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-48682

Affected Products

Acronis Cyber Protect 16

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-48682 · Security Note
• https://security-advisory.acronis.com/advisories/SEC-5901 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-48682 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1762561700358766911 · Twitter Post
• https://twitter.com/CVEnew/status/1762527270017908817 · Twitter Post
• https://t.me/cvenotify/72567 · Telegram Post
• https://t.me/cvenotify/72468 · Telegram Post