CVE-2024-56413
Jan. 2, 2025, 4:15 p.m.
Tags
CVSS Score
Product(s) Impacted
Acronis Cyber Protect
- before build 39169
Description
Missing session invalidation after user deletion. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169.
Weaknesses
CWE-613
Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
CWE ID: 613Date
Published: Jan. 2, 2025, 4:15 p.m.
Last Modified: Jan. 2, 2025, 4:15 p.m.
Status : Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
security@acronis.com
CVSS Data
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
Base Score
Exploitability Score
Impact Score
Base Severity
MEDIUMCVSS Vector String
The CVSS vector string provides an in-depth view of the vulnerability metrics.
View Vector StringCVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
References
https://security-advisory.acronis.com/
security@acronis.com