CVE-2023-48682: 
Acronis Cyber Protect vulnerability analysis and mitigation

A stored cross-site scripting (XSS) vulnerability was discovered in the unit name functionality of Acronis Cyber Protect 16 for Linux and Windows systems before build 37391. The vulnerability was assigned identifier CVE-2023-48682 and was disclosed on February 27, 2024 (NVD).

The vulnerability has been assessed with multiple CVSS scores. The NVD assigned a CVSS v3.1 base score of 5.4 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Acronis International GmbH rated it at 6.1 (MEDIUM) with vector CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

The vulnerability could lead to a security feature bypass, potentially allowing attackers to execute malicious scripts in the context of other users' browsers. This could result in the theft of sensitive information, session hijacking, or other malicious actions within the application context (NVD).

The vulnerability requires user interaction and authenticated access with low privileges to exploit. The attack complexity is considered low, indicating that the vulnerability is relatively straightforward to exploit once the necessary access conditions are met (NVD).

Users should upgrade to Acronis Cyber Protect 16 build 37391 or later to address this vulnerability. The fix has been implemented in the latest versions of the software (Vendor Advisory).