CVE-2021-38087: 
Acronis Cyber Protect vulnerability analysis and mitigation

Reflected cross-site scripting (XSS) vulnerability was discovered in the login page of Acronis Cyber Protect 15 prior to build 27009. The vulnerability was assigned CVE-2021-38087 and was disclosed on August 12, 2021 (NVD, CVE).

The vulnerability has been assessed with a CVSS v3.1 Base Score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. Under CVSS v2.0, it received a Base Score of 4.3 (MEDIUM) with vector (AV:N/AC:M/Au:N/C:N/I:P/A:N). The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

The vulnerability could allow an attacker to perform cross-site scripting attacks against users of the Acronis Cyber Protect 15 login page, potentially leading to unauthorized access to user data or session hijacking (NVD).

The vulnerability requires user interaction and can be exploited remotely without authentication. The attack complexity is considered low under CVSS v3.1 scoring (NVD).

Users should upgrade Acronis Cyber Protect 15 to build 27009 or later to address this vulnerability (NVD, Vendor Advisory).