CVE-2023-48679: 
Acronis Cyber Protect vulnerability analysis and mitigation

A stored cross-site scripting (XSS) vulnerability was discovered in Acronis Cyber Protect 16 (Linux, Windows) before build 37391. The vulnerability is due to missing origin validation in postMessage functionality (NVD, CVE).

The vulnerability has been assigned CVE-2023-48679 and has received a CVSS v3.1 base score of 5.4 (MEDIUM) from NIST with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Acronis International GmbH has assigned it a lower CVSS v3.0 score of 3.1 (LOW) with vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

The vulnerability could allow an attacker to execute malicious scripts in a user's browser context due to improper validation of postMessage origin, potentially leading to information disclosure and limited client-side manipulation (NVD).

The vulnerability requires user interaction and has a network attack vector. While the NIST assessment indicates low complexity, Acronis's assessment suggests high attack complexity with no privileges required (NVD).

Users should upgrade Acronis Cyber Protect 16 to build 37391 or later to address this vulnerability (NVD).