CVE-2020-35556: 
Acronis Cyber Protect vulnerability analysis and mitigation

An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. Because the local notification service misconfigures CORS, information disclosure can occur (NVD, Release Notes).

The vulnerability stems from a CORS (Cross-Origin Resource Sharing) misconfiguration in the local notification service of Acronis Cyber Protect. This security flaw has a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating it is network-accessible and requires no privileges or user interaction to exploit (NVD).

The vulnerability can lead to information disclosure, potentially exposing sensitive data to unauthorized parties. The CVSS score indicates high confidentiality impact, though there are no direct impacts on integrity or availability of the system (NVD).

The vulnerability is easily exploitable over a network without requiring authentication or user interaction. It can be accessed remotely by an unauthenticated attacker (NVD).

The vulnerability was fixed in Acronis Cyber Protect 15 Update 1 build 26172. Users should upgrade to this version or later to mitigate the security risk (Release Notes).