CVE-2023-44152CWE-306

Sensitive information disclosure and manipulation due to improper authentication

Medium · published September 27, 2023

CVSS v3.0
6.1
EPSS
1%
Percentile
59.4
In the wild
Unconfirmed
What it is

⚠️ Sensitive data is at risk! A simple authentication hiccup in Acronis Cyber Protect 15 could let attackers peek behind the curtain. 🔍 Think of it like a restaurant that forgets to check reservation IDs; anyone could waltz in and assume they belong at any table. This flaw allows unauthorized users to access or manipulate sensitive data as if they had a VIP pass! If left unaddressed, attackers could potentially view or alter sensitive information, compromising your security and privacy. Imagine someone accessing your personal files and changing critical details; it could lead to unauthorized actions and loss of trust.

Put simply

Think of it like a restaurant that forgets to check reservation IDs; anyone could waltz in and assume they belong at any table. This flaw allows unauthorized users to access or manipulate sensitive data as if they had a VIP pass! This vulnerability arises from improper authentication in Acronis Cyber Protect 15, affecting Linux, macOS, and Windows versions before build 35979, allowing unauthorized access to sensitive information.

What to do

If left unaddressed, attackers could potentially view or alter sensitive information, compromising your security and privacy. Imagine someone accessing your personal files and changing critical details; it could lead to unauthorized actions and loss of trust. To secure your system, upgrade Acronis Cyber Protect 15 to build 35979 or later immediately. Additionally, audit authentication mechanisms to ensure they are properly configured to prevent unauthorized access. You've got this! With these steps, you'll have your system locked down tight in no time. 🛡️

The record
Technical detail
CVSS v3.0
6.1 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00904 · 59.4th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2023-09-27T11:59Z
EPSS history
Timeline
  • 27 SEP 11:59Z
    Sensitive information disclosure and manipulation due to improper authentication
    cvelistv5