Lucene search

AcronisCVELIST:CVE-2022-3405

HistoryMay 03, 2023 - 10:49 a.m.

CVE-2022-3405

2023-05-0310:49:47

CWE-269

Acronis

www.cve.org

cve-2022-3405

acronis agent

excessive privileges

sensitive information

acronis cyber protect 15

acronis cyber backup 12.5

windows

linux

CVSS3

9.3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

25.9%

JSON

Code execution and sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 29486, Acronis Cyber Backup 12.5 (Windows, Linux) before build 16545.

CNA Affected

[
  {
    "vendor": "Acronis",
    "product": "Acronis Cyber Protect 15",
    "platforms": [
      "Windows",
      "Linux"
    ],
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "29486",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Acronis",
    "product": "Acronis Cyber Backup 12.5",
    "platforms": [
      "Windows",
      "Linux"
    ],
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "16545",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

herolab.usd.de/security-advisories/usd-2022-0008/

security-advisory.acronis.com/advisories/SEC-4092

CVSS3

9.3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

25.9%

JSON

Related for CVELIST:CVE-2022-3405