CVE-2022-45450
Published: 18 May 2023
Summary
CVE-2022-45450 is a high-severity Improper Authorization (CWE-285) vulnerability in Acronis Cyber Protect. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 50.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-48318
Vulnerability details
Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 28610, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 30984.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Authorization checks via training and content reviews ensure only approved information is released to public systems.
Documenting access to processing and storage locations helps ensure correct authorization for information resources.
Requiring explicit approval for maintenance activities and component removal enforces proper authorization for critical system operations.
Procedures enforce authorization rules for media handling, making unauthorized actions harder to perform without detection.
Limiting media access to authorized parties addresses improper authorization for resource access.
The control requires authorization mechanisms and senior approval to prevent unauthorized viewing or alteration of the plan.
Mandates authorization checks so public access cannot perform disallowed operations or modifications.
Decoys identify and block exploitation of improper authorization by providing monitored targets that mimic protected functions.