CVE-2022-30995 Information disclosure in Acronis Cyber Backup 12.5
Improper authentication in Acronis Cyber Protect and Backup allows attackers to disclose sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-30995?
CVE-2022-30995 is a critical vulnerability in Acronis Cyber Protect, published on 3 May 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Sensitive information disclosure due to improper authentication. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 29486, Acronis Cyber Backup 12.5 (Windows, Linux) before build 16545.
Weakness: CWE-287
Which versions are affected by CVE-2022-30995?
It affects 2 products.
Products include Acronis Cyber Backup, Acronis Cyber Protect.
How do I fix CVE-2022-30995?
No fix has been published for CVE-2022-30995 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-30995 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-30995 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in Acronis Cyber Protect
Sources
Also known as GHSA-wcwf-6v8x-jfhm.