CVE-2024-8767

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

Sensitive data disclosure and manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 619, Acronis Backup extension for Plesk (Linux) before build 555, Acronis Backup plugin for DirectAdmin (Linux) before build 147.

Metrics

CVSS 3.0 9.9/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-250

Affected software

Vendor	Product	Versions
Acronis	Acronis Backup plugin for cPanel & WHM	>= unspecified, < 619
Acronis	Acronis Backup extension for Plesk	>= unspecified, < 555
Acronis	Acronis Backup plugin for DirectAdmin	>= unspecified, < 147
acronis	backup_plugin_for_cpanel_\&_whm	< 619
acronis	backup_extension_for_plesk	< 555
acronis	backup_plugin_for_directadmin	< 147

References

https://security-advisory.acronis.com/advisories/SEC-4976

Timeline

Published: Sep 17, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-87687.5A flaw was found in the vLLM library. A completions API request with an empty prompt will crash the vLLM API server, resulting in a denial o CVE-2024-87699.1A vulnerability in the `LockManager.release_locks` function in aimhubio/aim (commit bb76afe) allows for arbitrary file deletion through rela CVE-2024-87706.1A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attac CVE-2024-87714.3The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vuln CVE-2024-87724.351l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition CVE-2024-87738.3SIMPLE.ERP client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vul CVE-2024-87747.7The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges t CVE-2024-87755.5A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a CVE-2024-87766.1SmartRobot from INTUMIT does not properly validate a specific page parameter, allowing unautheticated remote attackers to inject JavaScript CVE-2024-87777.5OMFLOW from The SYSCOM Group has an information leakage vulnerability, allowing unauthorized remote attackers to read arbitrary system confi CVE-2024-87786.5OMFLOW from The SYSCOM Group does not properly validate user input of the download functionality, allowing remote attackers with regular pri CVE-2024-87798.8OMFLOW from The SYSCOM Group does not properly restrict access to the system settings modification functionality, allowing remote attackers