Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2020-16171
HistorySep 21, 2020 - 2:15 p.m.

CVE-2020-16171

2020-09-2114:15:13
CWE-918
[email protected]
web.nvd.nist.gov
4
acronis cyber backup
ssrf attacks
api endpoints
vulnerability

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.056

Percentile

93.3%

JSON

An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342. Some API endpoints on port 9877 under /api/ams/ accept an additional custom Shard header. The value of this header is afterwards used in a separate web request issued by the application itself. This can be abused to conduct SSRF attacks against otherwise unreachable Acronis services that are bound to localhost such as the NotificationService on 127.0.0.1:30572.

Affected configurations

Nvd
Node
acroniscyber_backupRange≤12.5
Node
acroniscyber_backupMatch12.5-
OR
acroniscyber_backupMatch12.510130
OR
acroniscyber_backupMatch12.510330
OR
acroniscyber_backupMatch12.511010
OR
acroniscyber_backupMatch12.513160
OR
acroniscyber_backupMatch12.513400
OR
acroniscyber_backupMatch12.514280
OR
acroniscyber_backupMatch12.514330
OR
acroniscyber_backupMatch12.516180
OR
acroniscyber_backupMatch12.516318
OR
acroniscyber_backupMatch12.516327
OR
acroniscyber_backupMatch12.57641
OR
acroniscyber_backupMatch12.57970
OR
acroniscyber_backupMatch12.58850
OR
acroniscyber_backupMatch12.59010
VendorProductVersionCPE
acroniscyber_backup*cpe:2.3:a:acronis:cyber_backup:*:*:*:*:*:*:*:*
acroniscyber_backup12.5cpe:2.3:a:acronis:cyber_backup:12.5:-:*:*:*:*:*:*
acroniscyber_backup12.5cpe:2.3:a:acronis:cyber_backup:12.5:10130:*:*:*:*:*:*
acroniscyber_backup12.5cpe:2.3:a:acronis:cyber_backup:12.5:10330:*:*:*:*:*:*
acroniscyber_backup12.5cpe:2.3:a:acronis:cyber_backup:12.5:11010:*:*:*:*:*:*
acroniscyber_backup12.5cpe:2.3:a:acronis:cyber_backup:12.5:13160:*:*:*:*:*:*
acroniscyber_backup12.5cpe:2.3:a:acronis:cyber_backup:12.5:13400:*:*:*:*:*:*
acroniscyber_backup12.5cpe:2.3:a:acronis:cyber_backup:12.5:14280:*:*:*:*:*:*
acroniscyber_backup12.5cpe:2.3:a:acronis:cyber_backup:12.5:14330:*:*:*:*:*:*
acroniscyber_backup12.5cpe:2.3:a:acronis:cyber_backup:12.5:16180:*:*:*:*:*:*
Rows per page:
1-10 of 161

Related

exploitdb 1
cve 1
packetstorm 1
cnvd 1
cvelist 1
prion 1
exploitdb
exploitdb
Acronis Cyber Backup 12.5 Build 16341 - Unauthenticated SSRF
2020-11-27 00:00:00
cve
cve
CVE-2020-16171
2020-09-21 14:15:13
packetstorm
packetstorm
Acronis Cyber Backup 12.5 Build 16341 Server-Side Request Forgery
2020-09-16 00:00:00
cnvd
cnvd
Acronis Cyber Backup code issue vulnerability
2020-09-21 00:00:00
cvelist
cvelist
CVE-2020-16171
2020-09-21 13:07:07
prion
prion
Server side request forgery (ssrf)
2020-09-21 14:15:00

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.056

Percentile

93.3%

JSON
Related for NVD:CVE-2020-16171
exploitdb1cve1packetstorm1cnvd1cvelist1prion1