CVE-2022-24115

Published on: 02/04/2022 12:00:00 AM UTC

Last Modified on: 02/10/2022 03:38:00 PM UTC

CVE-2022-24115 - advisory for SEC-3359

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Certain versions of Cyber Protect Home Office from Acronis contain the following vulnerability:

Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Cyber Protect Home Office (macOS) before build 39605, Acronis True Image 2021 (macOS) before build 39287

CVE-2022-24115 has been assigned by [email protected] to track the vulnerability - currently rated as HIGH severity.
Affected Vendor/Software: Acronis - Acronis Cyber Protect Home Office version < 39605
Affected Vendor/Software: Acronis - Acronis True Image 2021 version < 39287

CVSS3 Score: 7.8 - HIGH

Attack Vector ^ⓘ	Attack Complexity	Privileges Required	User Interaction
LOCAL	LOW	LOW	NONE
Scope	Confidentiality Impact	Integrity Impact	Availability Impact
UNCHANGED	HIGH	HIGH	HIGH

CVSS2 Score: 4.6 - MEDIUM

Access Vector^ⓘ	Access Complexity	Authentication
LOCAL	LOW	NONE
Confidentiality Impact	Integrity Impact	Availability Impact
PARTIAL	PARTIAL	PARTIAL

CVE References

Description	Tags ^ⓘ	Link
Acronis Advisory Database - Acronis	security-advisory.acronis.com text/html	MISC security-advisory.acronis.com/advisories/SEC-3359

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].

There are currently no QIDs associated with this CVE

Known Affected Configurations (CPE V2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Acronis	Cyber Protect Home Office	-	All	All	All
Application	Acronis	True Image	2021	-	All	All
Application	Acronis	True Image	2021	update_1	All	All
Application	Acronis	True Image	2021	update_2	All	All
Application	Acronis	True Image	2021	update_3	All	All
Application	Acronis	True Image	2021	update_4	All	All
Operating System	Apple	Macos	-	All	All	All

cpe:2.3:a:acronis:cyber_protect_home_office:-:*:*:*:*:*:*:*:
cpe:2.3:a:acronis:true_image:2021:-:*:*:*:macos:*:*:
cpe:2.3:a:acronis:true_image:2021:update_1:*:*:*:macos:*:*:
cpe:2.3:a:acronis:true_image:2021:update_2:*:*:*:macos:*:*:
cpe:2.3:a:acronis:true_image:2021:update_3:*:*:*:macos:*:*:
cpe:2.3:a:acronis:true_image:2021:update_4:*:*:*:macos:*:*:
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*:

Discovery Credit

@vkas-afk (https://hackerone.com/vkas-afk)

Social Mentions

Source	Title	Posted (UTC)
@CVEreport	CVE-2022-24115 : Local privilege escalation due to unrestricted loading of unsigned libraries. The following produc… twitter.com/i/web/status/1…	2022-02-04 23:09:29