Vulnerability · Published Sep 17, 2024 · Assigned by Acronis
CVE-2024-8767
Critical 9.9
In plain English
A critical-severity security flaw in Acronis Backup extension for Plesk from Acronis. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS 3.0)9.9Critical
Exploit odds (30 days)0.5%top 58.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Sensitive data disclosure and manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 619, Acronis Backup extension for Plesk (Linux) before build 555, Acronis Backup plugin for DirectAdmin (Linux) before build 147.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Acronis | Acronis Backup plugin for cPanel & WHM | unspecified – before 619 |
| Acronis | Acronis Backup extension for Plesk | unspecified – before 555 |
| Acronis | Acronis Backup plugin for DirectAdmin | unspecified – before 147 |
Weakness: CWE-250 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- SEC-4976 vendor-advisory