PT-2024-9769 · Directadmin+3 · Directadmin+5

Milos Colakovic + 1 · Published 2024-04-29 · Updated 2025-02-27 · CVE-2024-34014

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Acronis Backup plugin for cPanel & WHM (Linux) versions before build 818 Acronis Backup extension for Plesk (Linux) versions before build 599 Acronis Backup plugin for DirectAdmin (Linux) versions before build 181

Description: The issue is related to arbitrary file overwrite during recovery due to improper symbolic link handling. This can allow a remote attacker to elevate their privileges.

Recommendations: For Acronis Backup plugin for cPanel & WHM (Linux) versions before build 818, update to build 818 or later. For Acronis Backup extension for Plesk (Linux) versions before build 599, update to build 599 or later. For Acronis Backup plugin for DirectAdmin (Linux) versions before build 181, update to build 181 or later.

Fix

Weakness Enumeration

CWE-61

Related Identifiers

BDU:2024-11515

CVE-2024-34014

Affected Products

Acronis Backup Extension For Plesk

Acronis Backup Plugin For Directadmin

Acronis Backup Plugin For Cpanel & Whm

Directadmin

Plesk

Cpanel & Whm

References · 9

• https://security-advisory.acronis.com/advisories/SEC-7592 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34014 · Security Note
• https://bdu.fstec.ru/vul/2024-11515 · Security Note
• https://twitter.com/CVEnew/status/1855969253788402105 · Twitter Post
• https://t.me/cvedetector/10501 · Telegram Post
• https://vuldb.com/pl/?id.283877 · Note
• https://t.me/cvenotify/101311 · Telegram Post
• https://github.com/advisories/GHSA-6c9g-ghq5-c4c8 · Note
• https://t.me/cvenotify/112723 · Telegram Post