CVE-2023-2782 MEDIUM

CVE-2023-2782

Vendor Acronis
Product Acronis Cyber Infrastructure
Weakness CWE-285
Published May 18, 2023
Last update January 22, 2025
View on NVD All CVEs

CVSS base score

5.5/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.3.1-38.

Key dates

02Disclosure timeline

May 18, 2023 CVE published
January 22, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-30793 RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation CVE-2021-28501 An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration. CVE-2023-21452 CVE-2017-1002151 CVE-2024-7851 SourceCodester Yoga Class Registration System Add User Users.php improper authorization