« Volver al listado

CVE-2025-24832

Estado: AplazadaMedia (5.5)—

Arbitrary file overwrite during home directory recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.4.866, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892, Acronis Backup extension for Plesk (Linux) before build 1.8.7.615.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Acronis — Backup Extension FOR PleskAIAcronis — Backup Plugin FOR Cpanel AND WHMAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-24832",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-24832",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-28T15:00:32.474414Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security@acronis.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@acronis.com",
      "affectedData": [
        {
          "vendor": "Acronis",
          "product": "Acronis Backup plugin for cPanel & WHM",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "1.8.4.866",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Acronis",
          "product": "Acronis Backup plugin for cPanel & WHM",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "1.9.1.892",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Acronis",
          "product": "Acronis Backup extension for Plesk",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "1.8.7.615",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-02-27T23:15:37.310",
  "references": [
    {
      "url": "https://security-advisory.acronis.com/advisories/SEC-7649",
      "source": "security@acronis.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@acronis.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-61"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Arbitrary file overwrite during home directory recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.4.866, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892, Acronis Backup extension for Plesk (Linux) before build 1.8.7.615."
    },
    {
      "lang": "es",
      "value": "Sobreescritura del archivo arbitrario durante la recuperación del directorio de inicio debido a la gestión inadecuada de enlaces simbólicos. Los siguientes productos se ven afectados: complemento de respaldo de Acronis para CPanel y WHM (Linux) antes de la compilación 1.8.4.866, complemento de respaldo de Acronis para Cpanel y WHM (Linux) antes de la compilación 1.9.1.892, Extensión de respaldo de Acronis para Plesk (Linux) antes de construir 1.8.7.615."
    }
  ],
  "lastModified": "2026-06-17T08:59:40.987",
  "sourceIdentifier": "security@acronis.com"
}