CVE-2023-44208CWE-862

Sensitive information disclosure and manipulation due to missing authorization

High · published October 4, 2023

CVSS v3.0
7.8
EPSS
0%
Percentile
29.4
In the wild
Unconfirmed
What it is

⚡ A simple oversight in Acronis products opens the door for unauthorized access to sensitive information! 🔥 Think of this as a hotel that forgets to check IDs at the front desk — just like letting in anyone without verification, unauthorized users could access private rooms they shouldn't be in. This vulnerability allows potential attackers to disclose or manipulate sensitive data, which could lead to serious privacy breaches. Imagine the chaos if your personal information was freely available to the wrong people! An attacker could alter crucial settings, compromising the integrity of your backups or sensitive files.

Put simply

Think of this as a hotel that forgets to check IDs at the front desk — just like letting in anyone without verification, unauthorized users could access private rooms they shouldn't be in. Due to missing authorization checks in Acronis Cyber Protect Home Office (Windows) before build 40713 and Acronis True Image OEM (Windows) before build 42575, attackers can access and manipulate sensitive information without proper authentication.

What to do

This vulnerability allows potential attackers to disclose or manipulate sensitive data, which could lead to serious privacy breaches. Imagine the chaos if your personal information was freely available to the wrong people! An attacker could alter crucial settings, compromising the integrity of your backups or sensitive files. To fix this, update Acronis Cyber Protect Home Office to build 40713 and Acronis True Image OEM to build 42575 immediately. Additionally, review user permissions and access controls to ensure sensitive data is appropriately protected. Don't delay this essential patching! You've got this! Follow these steps and take back control of your data security! 🛡️

The record
Technical detail
CVSS v3.0
7.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00367 · 29.4th percentile
Weakness
CWE-862 · Missing Authorization
Published
2023-10-04T11:47Z
EPSS history
Timeline
  • 04 OCT 11:47Z
    Sensitive information disclosure and manipulation due to missing authorization
    cvelistv5