CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-8427
https://notcve.org/view.php?id=CVE-2020-8427
In Unitrends Backup before 10.4.1, an HTTP request parameter was not properly sanitized, allowing for SQL injection that resulted in an authentication bypass. En Unitrends Backup en versiones anteriores a la 10.4.1, un parámetro de solicitud HTTP no fue saneado adecuadamente, permitiendo la inyección SQL que resultó en una omisión de autentificación • https://support.unitrends.com/UnitrendsBackup/s/article/000006983 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 3%CPEs: 1EXPL: 3CVE-2018-6329 – Unitrends Enterprise Backup bpserverd Privilege Escalation
https://notcve.org/view.php?id=CVE-2018-6329
It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing a remote attacker to place a privilege escalation exploit on the target system and subsequently execute arbitrary commands. Se ha descubierto que en Unitrends Backup (UB), en versiones anteriores a la 10.1.0, la autenticación libbpext.so podía omitirse con una inyección SQL que permitía que un atacante remoto colocase un exploit de escalado de privilegios en el sistema objetivo y, subsecuentemente, ejecute comandos arbitrarios. • https://www.exploit-db.com/exploits/45913 https://www.exploit-db.com/exploits/44297 https://support.unitrends.com/UnitrendsBackup/s/article/000001150 https://support.unitrends.com/UnitrendsBackup/s/article/000006003 https://support.unitrends.com/UnitrendsBackup/s/article/000005691 http://blog.redactedsec.net/exploits/2018/04/20/UEB9_tcp.html https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/local/ueb_bpserverd_privesc.rb • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2017-7283
https://notcve.org/view.php?id=CVE-2017-7283
An authenticated user of Unitrends Enterprise Backup before 9.1.2 can execute arbitrary OS commands by sending a specially crafted filename to the /api/restore/download-files endpoint, related to the downloadFiles function in api/includes/restore.php. Un usuario autenticado de Unitrends Enterprise Backup en versiones anteriores a 9.1.2 puede ejecutar comandos de SO arbitrarios enviando un nombre de archivo especialmente manipulado al punto final /api/restore/download-files, relacionado con la función downloadFiles en api/includes/restore.php. • https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-2 https://support.unitrends.com/UnitrendsBackup/s/article/ka640000000CcWBAA0/000005557?r=1 • CWE-20: Improper Input Validation •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-7282
https://notcve.org/view.php?id=CVE-2017-7282
An issue was discovered in Unitrends Enterprise Backup before 9.1.1. The function downloadFile in api/includes/restore.php blindly accepts any filename passed to /api/restore/download as valid. This allows an authenticated attacker to read any file in the filesystem that the web server has access to, aka Local File Inclusion (LFI). Se ha descubierto un problema en Unitrends Enterprise Backup en versiones anteriores a 9.1.1. La función downloadFile en api/includes/restore.php acepta ciegamente cualquier nombre de archivo pasado a /api/restore/download como válido. • https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-2 https://support.unitrends.com/UnitrendsBackup/s/article/ka640000000CcWGAA0/000005558?r=1 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-7284
https://notcve.org/view.php?id=CVE-2017-7284
An attacker that has hijacked a Unitrends Enterprise Backup (before 9.1.2) web server session can leverage api/includes/users.php to change the password of the logged in account without knowing the current password. This allows for an account takeover. Un atacante que ha secuestrado un Unitrends Enterprise Backup (en versiones anteriores a 9.1.2) sesión de servidor web puede aprovechar api/includes/users.php para cambiar la contraseña de la cuenta registrada sin conocer la contraseña actual. Esto permite una toma de control de la cuenta. • https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-1 • CWE-287: Improper Authentication •