CVE-2023-5042

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40713, Acronis True Image OEM (Windows) before build 42575.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
Acronis	Acronis Cyber Protect Home Office	>= unspecified, < 40713
Acronis	Acronis True Image OEM	>= unspecified, < 42575

References

https://security-advisory.acronis.com/advisories/SEC-5330Vendor Advisory
https://security-advisory.acronis.com/advisories/SEC-5330Vendor Advisory

Timeline

Published: Sep 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-504229.8SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from CVE-2023-504239.8SAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of privi CVE-2023-504249.8SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions < 0.17.0, allow under certain co CVE-2023-504285.3In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as cod CVE-2023-504299.1IzyBat Orange casiers before 20230803_1 allows getEnsemble.php ensemble SQL injection.CVE-2023-50438.8Ingress nginx annotation injection causes arbitrary command execution.CVE-2023-504306.4The Goodix Fingerprint Device, as shipped in Dell Inspiron 15 computers, does not follow the Secure Device Connection Protocol (SDCP) when e CVE-2023-504315.5sec_attest_info in drivers/accel/habanalabs/common/habanalabs_ioctl.c in the Linux kernel through 6.6.5 allows an information leak to user s CVE-2023-504325.3simple-dhcp-server through ec976d2 allows remote attackers to cause a denial of service (daemon crash) by sending a DHCP packet without any CVE-2023-504336.5marshall in dhcp_packet.c in simple-dhcp-server through ec976d2 allows remote attackers to cause a denial of service by sending a malicious CVE-2023-504349.8emdns_resolve_raw in emdns.c in emdns through fbd1eef calls strlen with an input that may not be '\0' terminated, leading to a stack-based b CVE-2023-504365.3An issue was discovered in Couchbase Server before 7.2.4. ns_server admin credentials are leaked in encoded form in the diag.log file. The e