CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2017-7283
https://notcve.org/view.php?id=CVE-2017-7283
An authenticated user of Unitrends Enterprise Backup before 9.1.2 can execute arbitrary OS commands by sending a specially crafted filename to the /api/restore/download-files endpoint, related to the downloadFiles function in api/includes/restore.php. Un usuario autenticado de Unitrends Enterprise Backup en versiones anteriores a 9.1.2 puede ejecutar comandos de SO arbitrarios enviando un nombre de archivo especialmente manipulado al punto final /api/restore/download-files, relacionado con la función downloadFiles en api/includes/restore.php. • https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-2 https://support.unitrends.com/UnitrendsBackup/s/article/ka640000000CcWBAA0/000005557?r=1 • CWE-20: Improper Input Validation •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-7282
https://notcve.org/view.php?id=CVE-2017-7282
An issue was discovered in Unitrends Enterprise Backup before 9.1.1. The function downloadFile in api/includes/restore.php blindly accepts any filename passed to /api/restore/download as valid. This allows an authenticated attacker to read any file in the filesystem that the web server has access to, aka Local File Inclusion (LFI). Se ha descubierto un problema en Unitrends Enterprise Backup en versiones anteriores a 9.1.1. La función downloadFile en api/includes/restore.php acepta ciegamente cualquier nombre de archivo pasado a /api/restore/download como válido. • https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-2 https://support.unitrends.com/UnitrendsBackup/s/article/ka640000000CcWGAA0/000005558?r=1 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7279
https://notcve.org/view.php?id=CVE-2017-7279
An unprivileged user of the Unitrends Enterprise Backup before 9.0.0 web server can escalate to root privileges by modifying the "token" cookie issued at login. Un usuario no privilegiado del Unitrends Enterprise Backup en versiones anteriores a 9.0.0 servidor de web puede escalar privilegios root modificando la cookie "token" emitida al iniciar sesión. • https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-1 • CWE-565: Reliance on Cookies without Validation and Integrity Checking •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2017-7280
https://notcve.org/view.php?id=CVE-2017-7280
An issue was discovered in api/includes/systems.php in Unitrends Enterprise Backup before 9.0.0. User input is not properly filtered before being sent to a popen function. This allows for remote code execution by sending a specially crafted user variable. Un problema ha sido descubierto en api/includes/systems.php en Unitrends Enterprise Backup en versiones anteriores a 9.0.0. La entrada de usuario no filtrada correctamente antes de ser enviada a una función popen. • https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-1 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-7281
https://notcve.org/view.php?id=CVE-2017-7281
An issue was discovered in Unitrends Enterprise Backup before 9.1.2. A lack of sanitization of user input in the createReportName and saveReport functions in recoveryconsole/bpl/reports.php allows for an authenticated user to create a randomly named file on disk with a user-controlled extension, contents, and path, leading to remote code execution, aka Unrestricted File Upload. Un problema ha sido descubierto en Unitrends Enterprise Backup en versiones anteriores a 9.1.2. Una falta de sanitización de la entrada de usuario en el createReportName y funciones saveReport en recoveryconsole/bpl/reports.php permite a un usuario autenticado a crear un archivo denominado aleatoriamente en disco con una extensión, un contenido y una ruta controlados por el usuario, conduciendo a la ejecución remota de código, también conocido como Unrestricted File Upload. • https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-1 • CWE-434: Unrestricted Upload of File with Dangerous Type •