Cyber Resilience

CVE-2023-2360

Acronis Cyber Infrastructure ≤ 5.2.0-135

Published
28 April 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0039 32th percentile
Risk Priority 57 floored blend · peak EPSS

Summary

CVE-2023-2360 is a high-severity Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942) vulnerability in Acronis Cyber Infrastructure. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A02:2025 Security Misconfiguration

EU & UK References

Vulnerability Data

Sensitive information disclosure due to CORS misconfiguration. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.2.0-135.

CWE(s)
CWE-942NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise Techniques

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
attack.mitre.org →
T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
attack.mitre.org →
T1659 Content Injection Initial Access
Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-45249Same product: Acronis Cyber Infrastructure
CVE-2023-2782Same product: Acronis Cyber Infrastructure
CVE-2025-13984Shared CWE-942
CVE-2025-55274Shared CWE-942
CVE-2026-34449Shared CWE-942
CVE-2024-23578Shared CWE-942
CVE-2026-10056Shared CWE-942
CVE-2026-46431Shared CWE-942
CVE-2025-25234Shared CWE-942
CVE-2025-43480Shared CWE-942

Affected Assets

acronis
cyber infrastructure
≤ 5.2.0-135

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V3.4.3
  • V3.4.6
  • V3.5.2

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-01 mostly match
prevents

Hardened configuration baselines and reviews directly prevent permissive CSP or cross-domain policies.

PR.PS-06 mostly match
prevents

Secure SDLC activities include review and testing of web security policies to avoid untrusted domains.

ID.RA-01 partial match
prevents

Vulnerability identification processes can surface permissive policy misconfigurations.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect overly permissive cross-domain policies but does not prevent their initial introduction.

A.8.20 Networks security partial match
degrades

Network security policies can restrict cross-domain communication but do not specifically mandate strict CSP or cross-domain policy configuration.

A.8.21 Security of network services partial match
degrades

Security of network services includes defining allowed endpoints, which can limit untrusted domains but does not directly address web-client policy files.

A.8.23 Web filtering partial match
degrades

Web filtering can block untrusted domains at the network level, partially mitigating permissive cross-domain policies.

A.8.26 Application security requirements partial match
prevents

Application security requirements should specify secure CSP and cross-domain policy settings, directly addressing the weakness.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles include defining trust boundaries, which can reduce permissive cross-domain allowances.

References