An attacker that has hijacked a Unitrends Enterprise Backup (before 9.1.2) web server session can leverage api/includes/users.php to change the password of the logged in account without knowing the current password. This allows for an account takeover.
Max CVSS
8.8
EPSS Score
0.11%
Published
2017-04-12
Updated
2019-10-03
An authenticated user of Unitrends Enterprise Backup before 9.1.2 can execute arbitrary OS commands by sending a specially crafted filename to the /api/restore/download-files endpoint, related to the downloadFiles function in api/includes/restore.php.
Max CVSS
9.0
EPSS Score
0.11%
Published
2017-04-20
Updated
2017-04-24
An issue was discovered in Unitrends Enterprise Backup before 9.1.1. The function downloadFile in api/includes/restore.php blindly accepts any filename passed to /api/restore/download as valid. This allows an authenticated attacker to read any file in the filesystem that the web server has access to, aka Local File Inclusion (LFI).
Max CVSS
7.1
EPSS Score
0.07%
Published
2017-04-20
Updated
2017-04-25
An issue was discovered in Unitrends Enterprise Backup before 9.1.2. A lack of sanitization of user input in the createReportName and saveReport functions in recoveryconsole/bpl/reports.php allows for an authenticated user to create a randomly named file on disk with a user-controlled extension, contents, and path, leading to remote code execution, aka Unrestricted File Upload.
Max CVSS
8.8
EPSS Score
0.28%
Published
2017-04-12
Updated
2017-04-20
An issue was discovered in api/includes/systems.php in Unitrends Enterprise Backup before 9.0.0. User input is not properly filtered before being sent to a popen function. This allows for remote code execution by sending a specially crafted user variable.
Max CVSS
9.8
EPSS Score
1.45%
Published
2017-04-12
Updated
2017-04-20
An unprivileged user of the Unitrends Enterprise Backup before 9.0.0 web server can escalate to root privileges by modifying the "token" cookie issued at login.
Max CVSS
10.0
EPSS Score
0.22%
Published
2017-04-12
Updated
2019-10-03
recoveryconsole/bpl/snmpd.php in Unitrends Enterprise Backup 7.3.0 allows remote attackers to bypass authentication by setting the auth parameter to a certain string.
Max CVSS
7.5
EPSS Score
0.34%
Published
2014-05-02
Updated
2014-05-05
Unitrends Enterprise Backup 7.3.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the comm parameter to recoveryconsole/bpl/snmpd.php.
Max CVSS
10.0
EPSS Score
1.86%
Published
2014-04-28
Updated
2017-08-29
8 vulnerabilities found
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!