Lucene search

AcronisCVE-2023-48677

HistoryDec 12, 2023 - 9:15 a.m.

CVE-2023-48677

2023-12-1209:15:08

CWE-427

Acronis

web.nvd.nist.gov

cve-2023-48677

local privilege escalation

dll hijacking vulnerability

acronis cyber protect home office

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

21.1%

JSON

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40901.

Affected configurations

Nvd

Node

acroniscyber_protect_home_officeRange<40901

AND

microsoftwindowsMatch-

VendorProductVersionCPE
acroniscyber_protect_home_office*cpe:2.3:a:acronis:cyber_protect_home_office:*:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
acronis	cyber_protect_home_office	*	cpe:2.3:a:acronis:cyber_protect_home_office::::::::
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*

CNA Affected

[
  {
    "vendor": "Acronis",
    "product": "Acronis Cyber Protect Home Office",
    "platforms": [
      "Windows"
    ],
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "40901",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

security-advisory.acronis.com/advisories/SEC-5620

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

21.1%

JSON

Related for CVE-2023-48677