CVE-2023-44206CWE-639

Sensitive information disclosure and manipulation due to improper authorization

High · published September 27, 2023

CVSS v3.0
7.1
EPSS
1%
Percentile
63.3
In the wild
Unconfirmed
What it is

⚡ A serious oversight in Acronis Cyber Protect 15 could let unauthorized users access and manipulate sensitive information — like handing out keys to a high-security vault without a proper check! 🔑 Think of it like a hotel concierge who gives out room keys without verifying guests' identities. Anyone could waltz in, change up the room's furnishings, and scoot out without a trace! The consequences here could be absolutely devastating. An attacker could easily gain access to sensitive data, modify crucial configurations, or even compromise user accounts. This isn't just a minor inconvenience — it could jeopardize entire systems and lead to significant data breaches!

Put simply

Think of it like a hotel concierge who gives out room keys without verifying guests' identities. Anyone could waltz in, change up the room's furnishings, and scoot out without a trace! This vulnerability stems from improper authorization checks in Acronis Cyber Protect 15, allowing unauthorized users to disclose or modify sensitive information across both the Linux and Windows versions before build 35979.

What to do

The consequences here could be absolutely devastating. An attacker could easily gain access to sensitive data, modify crucial configurations, or even compromise user accounts. This isn't just a minor inconvenience — it could jeopardize entire systems and lead to significant data breaches! To safeguard your systems, patch to build 35979 immediately. Review user authorization settings and ensure that only authenticated users have proper access to sensitive data. Conduct a thorough audit of all access logs for suspicious activities. You've got this! Secure your Acronis Cyber Protect installation today and keep that vault locked tight! 🛡️

The record
Technical detail
CVSS v3.0
7.1 · HIGH
Vector
CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01027 · 63.3th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2023-09-27T12:02Z
EPSS history
Timeline
  • 27 SEP 12:02Z
    Sensitive information disclosure and manipulation due to improper authorization
    cvelistv5