diff --git "a/docs/advisories/\"https:/nvd.nist.gov/vuln/detail/CVE-2021-35515\"" "b/docs/advisories/\"https:/nvd.nist.gov/vuln/detail/CVE-2021-35515\"" deleted file mode 100644 index e69de29b..00000000 diff --git a/docs/advisories/20240729001-Acronis-Releases-Critical-Security-Advisory.md b/docs/advisories/20240729001-Acronis-Releases-Critical-Security-Advisory.md new file mode 100644 index 00000000..5206cd09 --- /dev/null +++ b/docs/advisories/20240729001-Acronis-Releases-Critical-Security-Advisory.md @@ -0,0 +1,22 @@ +# Acronis Releases Critical Security Advisory - 20240729001 + +## Overview + +Acronis has released a critical advisory related to a vulnerability found in their Acronis Cyber Infrastructure (ACI) product that could allow attackers to bypass authentication on vulnerable servers using default credentials. + +## What is vulnerable? + +| Product(s) Affected | Version(s) | CVE | CVSS | Severity | +| --- | --- | --- | --- | --- | +| Acronis Cyber Infrastructure (ACI) | 5.0.1 before build -61
5.1.1 before build -71
5.2.1 before build -69
5.3.1 before build -53
5.4.4 before build -132 | [CVE-2023-45249](https://nvd.nist.gov/vuln/detail/CVE-2023-45249) | 9.8 | **Critical** | + + +## Recommendation + +The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *48 hours...* (refer [Patch Management](../guidelines/patch-management.md)): + +- Acronis advisory: + +## Additional References + +- BleepingComputer article: