Lucene search

AcronisCVE-2022-3405

HistoryMay 03, 2023 - 11:15 a.m.

CVE-2022-3405

2023-05-0311:15:11

CWE-269

Acronis

web.nvd.nist.gov

cve-2022-3405

code execution

sensitive information disclosure

acronis cyber protect

acronis cyber backup

nvd

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

25.9%

JSON

Code execution and sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 29486, Acronis Cyber Backup 12.5 (Windows, Linux) before build 16545.

Affected configurations

Nvd

Node

linuxlinux_kernelMatch-

microsoftwindowsMatch-

AND

acroniscyber_backupMatch12.5-

acroniscyber_backupMatch12.510130

acroniscyber_backupMatch12.510330

acroniscyber_backupMatch12.511010

acroniscyber_backupMatch12.513160

acroniscyber_backupMatch12.513400

acroniscyber_backupMatch12.514280

acroniscyber_backupMatch12.514330

acroniscyber_backupMatch12.516180

acroniscyber_backupMatch12.516318

acroniscyber_backupMatch12.516327

acroniscyber_backupMatch12.57641

acroniscyber_backupMatch12.57970

acroniscyber_backupMatch12.58850

acroniscyber_backupMatch12.59010

acroniscyber_protectMatch15-

acroniscyber_protectMatch15update1

acroniscyber_protectMatch15update2

acroniscyber_protectMatch15update3

VendorProductVersionCPE
linuxlinux_kernel-cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
acroniscyber_backup12.5cpe:2.3:a:acronis:cyber_backup:12.5:-:*:*:*:*:*:*
acroniscyber_backup12.5cpe:2.3:a:acronis:cyber_backup:12.5:10130:*:*:*:*:*:*
acroniscyber_backup12.5cpe:2.3:a:acronis:cyber_backup:12.5:10330:*:*:*:*:*:*
acroniscyber_backup12.5cpe:2.3:a:acronis:cyber_backup:12.5:11010:*:*:*:*:*:*
acroniscyber_backup12.5cpe:2.3:a:acronis:cyber_backup:12.5:13160:*:*:*:*:*:*
acroniscyber_backup12.5cpe:2.3:a:acronis:cyber_backup:12.5:13400:*:*:*:*:*:*
acroniscyber_backup12.5cpe:2.3:a:acronis:cyber_backup:12.5:14280:*:*:*:*:*:*
acroniscyber_backup12.5cpe:2.3:a:acronis:cyber_backup:12.5:14330:*:*:*:*:*:*

Vendor	Product	Version	CPE
linux	linux_kernel	-	cpe:2.3:o:linux:linux_kernel:-:::::::*
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*
acronis	cyber_backup	12.5	cpe:2.3:a:acronis:cyber_backup:12.5:-::::::
acronis	cyber_backup	12.5	cpe:2.3:a:acronis:cyber_backup:12.5:10130::::::
acronis	cyber_backup	12.5	cpe:2.3:a:acronis:cyber_backup:12.5:10330::::::
acronis	cyber_backup	12.5	cpe:2.3:a:acronis:cyber_backup:12.5:11010::::::
acronis	cyber_backup	12.5	cpe:2.3:a:acronis:cyber_backup:12.5:13160::::::
acronis	cyber_backup	12.5	cpe:2.3:a:acronis:cyber_backup:12.5:13400::::::
acronis	cyber_backup	12.5	cpe:2.3:a:acronis:cyber_backup:12.5:14280::::::
acronis	cyber_backup	12.5	cpe:2.3:a:acronis:cyber_backup:12.5:14330::::::

Rows per page:

1-10 of 211

CNA Affected

[
  {
    "vendor": "Acronis",
    "product": "Acronis Cyber Protect 15",
    "platforms": [
      "Windows",
      "Linux"
    ],
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "29486",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Acronis",
    "product": "Acronis Cyber Backup 12.5",
    "platforms": [
      "Windows",
      "Linux"
    ],
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "16545",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

herolab.usd.de/security-advisories/usd-2022-0008/

security-advisory.acronis.com/advisories/SEC-4092

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

25.9%

JSON

Related for CVE-2022-3405