CVE-2022-30995

published 2023-05-03

CVE-2022-30995: Sensitive information disclosure due to improper authentication. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build…

Priority P3 54 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

Sensitive information disclosure due to improper authentication. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 29486, Acronis Cyber Backup 12.5 (Windows, Linux) before build 16545.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
acronis	acronis_cyber_backup_12.5	>= unspecified < 16545	16545
acronis	acronis_cyber_protect_15	>= unspecified < 29486	29486
acronis	cyber_backup	—	—
acronis	cyber_protect	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /api/ams/agents↗

other Bearer token (unauthenticated/anonymous agent registration token used for admin web console access)↗

• → Monitor for unauthenticated/anonymous POST requests to the agent registration API endpoint on the Acronis Cyber Protect/Backup management port. Successful anonymous registration will result in a bearer token being issued without prior authentication. ↗
• → Alert on bearer tokens being used against the management web console API that were issued via the agent registration endpoint without a preceding authenticated session, as the same port serves both the agent API and the admin web console. ↗
• → Correlate use of this auxiliary module with the follow-on RCE module `exploit/multi/acronis_cyber_protect_unauth_rce_cve_2022_3405`; detection of machine info enumeration (endpoint listing) may precede an RCE attempt. ↗

• · The vulnerability is exploitable only in the default configuration of Acronis Cyber Protect/Backup, which permits anonymous agent registration. Hardening the appliance to require authenticated agent registration would mitigate this attack vector. ↗
• · Affected versions: Acronis Cyber Protect 15 (Windows, Linux) before build 29486 and Acronis Cyber Backup 12.5 (Windows, Linux) before build 16545. Patched builds are not vulnerable. ↗

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v3.0 9.3 CRITICAL CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-287