Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-16171

An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342. Some API endpoints on port 9877 under /api/ams/ accept an additional custom Shard header. The value of this header is afterwards used in a separate web request issued by the application itself. This can be abused to conduct SSRF attacks against otherwise unreachable Acronis services that are bound to localhost such as the NotificationService on 127.0.0.1:30572.

Published

2020-09-21T14:15:13.370

Last Modified

2024-11-21T05:06:54.360

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

4.9

Weaknesses
  • Type: Primary
    CWE-918
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application acronis cyber_backup ≤ 12.5 Yes
Application acronis cyber_backup 12.5 Yes
Application acronis cyber_backup 12.5 Yes
Application acronis cyber_backup 12.5 Yes
Application acronis cyber_backup 12.5 Yes
Application acronis cyber_backup 12.5 Yes
Application acronis cyber_backup 12.5 Yes
Application acronis cyber_backup 12.5 Yes
Application acronis cyber_backup 12.5 Yes
Application acronis cyber_backup 12.5 Yes
Application acronis cyber_backup 12.5 Yes
Application acronis cyber_backup 12.5 Yes
Application acronis cyber_backup 12.5 Yes
Application acronis cyber_backup 12.5 Yes
Application acronis cyber_backup 12.5 Yes
Application acronis cyber_backup 12.5 Yes
References