CVE-2020-10140CWE-732

Acronis True Image 2021 fails to properly set ACLs of the C:\ProgramData\Acronis directory

High · published October 21, 2020

CVSS v3.1
7.8
EPSS
0%
Percentile
30.9
In the wild
Unconfirmed
What it is

Acronis True Image 2021 fails to properly set ACLs of the C:\ProgramData\Acronis directory. Because some privileged processes are executed from the C:\ProgramData\Acronis, an unprivileged user can achieve arbitrary code execution with SYSTEM privileges by placing a DLL in one of several paths within C:\ProgramData\Acronis.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00381 · 30.9th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2020-10-21T13:40Z
EPSS history
Timeline
  • 21 OCT 13:40Z
    Acronis True Image 2021 fails to properly set ACLs of the C:\ProgramData\Acronis directory
    cvelistv5