CVE-2023-45242

Plain English Summary

AI-powered analysis for quick understanding

This vulnerability allows an attacker to access sensitive information from Acronis Cyber Protect products due to a lack of proper authorization controls. It affects versions prior to specific builds, meaning that if your software is outdated, an attacker could exploit this flaw to retrieve confidential data without permission.

Technical Description

Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 35739, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.

CVSS Vector Analysis

Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
Confidentiality ImpactHigh
Integrity ImpactNone
Availability ImpactNone
ScopeUnchanged

Vector String

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploit Resources

Search for proof-of-concept code and exploit modules

Official References

Est. Bounty
$759($500-$1K)
Vendor Response
Grade FPatched in 882 days

Quick Information

Published

Oct 5, 2023

over 2 years ago

Last Modified

Mar 6, 2026

about 1 month ago

Vendor

acronis

Product

agent