CVE-2023-48683: 
Acronis Cyber Protect vulnerability analysis and mitigation

Sensitive information disclosure and manipulation vulnerability (CVE-2023-48683) affects Acronis Cyber Protect Cloud Agent and Acronis Cyber Protect 16 across Linux, macOS, and Windows platforms. The vulnerability was discovered due to missing authorization mechanisms (Acronis Advisory).

The vulnerability has been assigned a CVSS v3.0 score of 7.1 (High), with the vector string CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. This indicates a local attack vector requiring low attack complexity and low privileges, with no user interaction needed. The scope is unchanged, but the impact includes high severity ratings for both confidentiality and integrity, while availability is not affected (Acronis Advisory).

The vulnerability allows unauthorized access to sensitive information and potential manipulation of data. The high confidentiality and integrity impact ratings suggest that attackers could both access and modify sensitive data within the affected systems (Acronis Advisory).

The vulnerability requires local access to the system with low privileges to exploit. The attack complexity is rated as low, indicating that the vulnerability is relatively straightforward to exploit once access is obtained (Acronis Advisory).

The vulnerability has been patched in Acronis Cyber Protect Cloud Agent build 37758 and Acronis Cyber Protect 16 build 39169. Users are advised to update to these or later versions to mitigate the vulnerability (Acronis Advisory).