Paper/Archive/CVE-2024-8767

CVE-2024-8767

Acronis Acronis Backup plugin for cPanel & WHM — Sensitive data disclosure and manipulation due to unnecessary privileges assignment.

EPSS 0.5%CVSS 9.9

critical.is priorityof 100

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 41.1.411 × 208.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Sensitive data disclosure and manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 619, Acronis Backup extension for Plesk (Linux) before build 555, Acronis Backup plugin for DirectAdmin (Linux) before build 147.

Affected

ProductAffectedFixed inSource

Acronis Backup plugin for cPanel & WHMunspecified – < 619619CNA

Acronis Backup extension for Pleskunspecified – < 555555CNA

Acronis Backup plugin for DirectAdminunspecified – < 147147CNA

backup_plugin_for_cpanel_\&_whm< 619619CISA-ADP

backup_extension_for_plesk< 555555CISA-ADP

backup_plugin_for_directadmin< 147147CISA-ADP

Scores by source

Acronis (CNA)9.9CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorysecurity-advisory.acronis.com/advisories/SEC-4976