CVE-2024-34014 MEDIUM

CVE-2024-34014

Vendor Acronis

Product Acronis Backup plugin for cPanel & WHM

Weakness CWE-61

Published November 11, 2024

Last update February 27, 2025

View on NVD All CVEs

CVSS base score

5.5/10

Attack vector Local

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality None

Integrity High

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

Arbitrary file overwrite during recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.3.818, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892, Acronis Backup extension for Plesk (Linux) before build 1.8.6.599, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.2.181.

Key dates

02Disclosure timeline

November 11, 2024 CVE published

February 27, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-34014 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/61.html

Identifiers

CVE CVE-2024-34014

CWE CWE-61

CVSS 5.5 / MEDIUM

Affected versions

Vendor Acronis

Product Acronis Backup plugin for cPanel & WHM

Affected ≥ unspecified and < 1.8.3.818

Vendor Acronis

Product Acronis Backup plugin for cPanel & WHM

Affected ≥ unspecified and < 1.9.1.892

Vendor Acronis

Product Acronis Backup extension for Plesk

Affected ≥ unspecified and < 1.8.6.599

Vendor Acronis

Product Acronis Backup plugin for DirectAdmin

Affected ≥ unspecified and < 1.2.2.181