CVE-2024-49385 in True Image
Summary
by MITRE • 01/02/2025
Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) before build 41736, Acronis True Image OEM (Windows) before build 42575.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/15/2026
The vulnerability identified as CVE-2024-49385 represents a critical sensitive information disclosure issue affecting Acronis True Image and its OEM variant on Windows platforms. This flaw stems from insecure folder permissions that allow unauthorized access to protected data within the application's file structure. The affected versions prior to build 41736 for standard Acronis True Image and build 42575 for OEM versions demonstrate a significant security gap in the application's access control mechanisms. The vulnerability exposes sensitive user data through improper file system permissions that should restrict access to authorized users only.
The technical implementation of this vulnerability involves the application's failure to properly enforce access controls on critical data directories. When Acronis True Image creates backup storage locations or temporary folders during operation, these directories are configured with overly permissive permissions that allow any user account on the system to access sensitive backup metadata, configuration files, or partial backup content. This misconfiguration creates an attack surface where local users or compromised processes can extract valuable information including user credentials, system configurations, backup schedules, and potentially partial backup data that may contain personal or confidential information.
From an operational impact perspective, this vulnerability significantly undermines the security posture of systems running affected Acronis versions. The disclosure of sensitive information through insecure folder permissions aligns with CWE-276 which specifically addresses incorrect permissions for critical resources. Attackers with local access can exploit this weakness to gather intelligence about backup operations, system configurations, and potentially user data that could be leveraged for further attacks. The vulnerability creates opportunities for privilege escalation and lateral movement within compromised environments where backup systems are used to store sensitive organizational data.
The security implications extend beyond simple information disclosure as this vulnerability can facilitate more sophisticated attacks within the ATT&CK framework. Specifically, the insecure permissions create conditions that support techniques categorized under privilege escalation and credential access. Adversaries can use the leaked information to better understand system configurations and backup strategies, potentially enabling more targeted attacks against the backup infrastructure. This vulnerability also represents a failure in the principle of least privilege, where system components should only have access to resources necessary for their operation rather than broad permissions that expose sensitive data.
Mitigation strategies for CVE-2024-49385 require immediate implementation of proper access control measures on affected systems. Organizations should ensure that all Acronis True Image installations are updated to the latest builds that address the insecure folder permissions issue. System administrators must verify and correct folder permissions on backup storage directories to restrict access to authorized users only. The remediation process should include reviewing all backup-related directories and ensuring they are configured with appropriate security settings that prevent unauthorized access while maintaining legitimate application functionality. Additionally, organizations should implement regular security audits of backup systems to identify and address similar permission-related vulnerabilities that could compromise sensitive data confidentiality and integrity.