CVE-2017-12478

It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of its input parameters was not validated. A remote attacker could use this flaw to bypass authentication and execute arbitrary commands with root privilege on the target system.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 98%
VendorProductVersion
kaseyaunitrends_backup
𝑥
< 10.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://support.unitrends.com/UnitrendsBackup/s/article/000005756
https://www.exploit-db.com/exploits/43030/
https://www.exploit-db.com/exploits/45559/
https://support.unitrends.com/UnitrendsBackup/s/article/000005756
https://www.exploit-db.com/exploits/43030/
https://www.exploit-db.com/exploits/45559/