CVE-2020-10138

Katalog CVE

CVSS 7.8 · High EPSS 0,53%

Kerentanan Improper Access Control pada acronis cyber backup, acronis cyber protect. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Acronis Cyber Backup 12.5 and Cyber Protect 15 include an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\. Acronis Cyber Backup and Cyber Protect contain a privileged service that uses this OpenSSL component. Because unprivileged Windows users can create subdirectories off of the system root, a user can create the appropriate path to a specially-crafted openssl.cnf file to achieve arbitrary code execution with SYSTEM privileges.

Rincian

Terbit di NVD

21 Oktober 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-665: Improper Initialization

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.kb.cert.org/vuls/id/114757 advisory pihak ketiga · pemerintah AS