Medium severity · published Sep 21, 2020
CVE-2020-16171
An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342
6.5
CVSS
5.5%
EPSS
No
On KEV
Description
An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342. Some API endpoints on port 9877 under /api/ams/ accept an additional custom Shard header. The value of this header is afterwards used in a separate web request issued by the application itself. This can be abused to conduct SSRF attacks against otherwise unreachable Acronis services that are bound to localhost such as the NotificationService on 127.0.0.1:30572.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.5% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CB
Cyber Backup · Acronis
through 12.5; 12.5; 12.5; 12.5; 12.5; 12.5; +10 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-16171
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-16171
Exploit
http://seclists.org/fulldisclosure/2020/Sep/33
Third Party Advisory
https://www.rcesecurity.com/2020/09/CVE-2020-16171-Exploiting-Acronis-Cyber-Backup-for-Fun-and-Emails/
More from Cyber Backup
8.8
CVE-2022-3405
Code execution and sensitive information disclosure due to excessive privileges assigned to Acronis Agent
7.8
CVE-2020-10138
Acronis Cyber Backup 12.5 and Cyber Protect 15 include an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\
7.5
CVE-2022-30995
Sensitive information disclosure due to improper authentication