« Volver al listado

CVE-2024-8767

Estado: AplazadaCrítica (9.9)—

Sensitive data disclosure and manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 619, Acronis Backup extension for Plesk (Linux) before build 555, Acronis Backup plugin for DirectAdmin (Linux) before build 147.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Acronis — Backup Extension FOR PleskAIAcronis — Backup Plugin FOR Cpanel AND WHMAIAcronis — Backup Plugin FOR DirectadminAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-8767",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-8767",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-17T13:35:06.655286Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security@acronis.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security@acronis.com",
      "affectedData": [
        {
          "vendor": "Acronis",
          "product": "Acronis Backup plugin for cPanel & WHM",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "619",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Acronis",
          "product": "Acronis Backup extension for Plesk",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "555",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Acronis",
          "product": "Acronis Backup plugin for DirectAdmin",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "147",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:acronis:backup_plugin_for_cpanel_\\&_whm:*:*:*:*:*:*:*:*"
          ],
          "vendor": "acronis",
          "product": "backup_plugin_for_cpanel_\\&_whm",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "619",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:acronis:backup_extension_for_plesk:*:*:*:*:*:*:*:*"
          ],
          "vendor": "acronis",
          "product": "backup_extension_for_plesk",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "555",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:acronis:backup_plugin_for_directadmin:*:*:*:*:*:*:*:*"
          ],
          "vendor": "acronis",
          "product": "backup_plugin_for_directadmin",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "147",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-09-17T09:15:03.423",
  "references": [
    {
      "url": "https://security-advisory.acronis.com/advisories/SEC-4976",
      "source": "security@acronis.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@acronis.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-250"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Sensitive data disclosure and manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 619, Acronis Backup extension for Plesk (Linux) before build 555, Acronis Backup plugin for DirectAdmin (Linux) before build 147."
    },
    {
      "lang": "es",
      "value": "Divulgación y manipulación de datos confidenciales debido a la asignación innecesaria de privilegios. Los siguientes productos se ven afectados: complemento de Acronis Backup para cPanel y WHM (Linux) anterior a la compilación 619, extensión de Acronis Backup para Plesk (Linux) anterior a la compilación 555, complemento de Acronis Backup para DirectAdmin (Linux) anterior a la compilación 147."
    }
  ],
  "lastModified": "2026-06-17T08:23:15.937",
  "sourceIdentifier": "security@acronis.com"
}