CVE-2020-16171 is a Server-Side Request Forgery (SSRF) vulnerability affecting Acronis Cyber Backup versions prior to 12.5 Build 16342. It allows an unauthenticated attacker to manipulate the "Shard" header in API requests on port 9877, forcing the application to make requests to internal, otherwise inaccessible Acronis services bound to localhost. This vulnerability has a CVSS v3.1 score of 6.5 (Medium), indicating a network-based attack with low complexity, requiring no privileges or user interaction, and potentially leading to low confidentiality and integrity impacts. While not listed on the KEV catalog or Hot List, a public exploit (EDB-49113) exists, demonstrating its exploitability. Despite this, there is no evidence of active exploitation, and it has received minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 12.5CPE matchmatch criteria | cpe:2.3:a:acronis:cyber_backup:*:*:*:*:*:*:*:* | ||
12.5CPE matchmatch criteria | cpe:2.3:a:acronis:cyber_backup:12.5:-:*:*:*:*:*:* | ||
12.5CPE matchmatch criteria | cpe:2.3:a:acronis:cyber_backup:12.5:10130:*:*:*:*:*:* | ||
12.5CPE matchmatch criteria | cpe:2.3:a:acronis:cyber_backup:12.5:10330:*:*:*:*:*:* | ||
12.5CPE matchmatch criteria | cpe:2.3:a:acronis:cyber_backup:12.5:11010:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.