PT-2024-7387 · Acronis · Acronis Cyber Protect

Published 2024-10-15 · Updated 2025-02-04 · CVE-2024-49388

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect 16 versions before build 38690

Description: The issue is related to sensitive information manipulation due to improper authorization. This can be exploited by an attacker to elevate their privileges. The vulnerability exists because of improper authorization, allowing a remote attacker to potentially expose data.

Recommendations: For Acronis Cyber Protect 16 versions before build 38690, update to a version that includes the fix for this issue, specifically build 38690 or later. As a temporary workaround, consider restricting access to sensitive information and implementing additional authorization controls until the update can be applied.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BDU:2024-08756

CVE-2024-49388

Affected Products

Acronis Cyber Protect

References · 10

• https://security-advisory.acronis.com/advisories/SEC-5984 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08756 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-49388 · Security Note
• https://osv.dev/vulnerability/CVE-2024-49388 · Vendor Advisory
• https://t.me/cvedetector/7901 · Telegram Post
• https://security-database.com/detail.php?alert=CVE-2024-49388 · Note
• https://t.me/cvenotify/109897 · Telegram Post
• https://twitter.com/CVEnew/status/1846140027883176230 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1846199021490069999 · Twitter Post
• https://vuldb.com/?id.280369 · Note