CVE-2018-6328

Опубликовано: 14 мар. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Высокий

Описание

It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unauthenticated user to inject arbitrary commands into its /api/hosts parameters using backquotes.

Ссылки

https://support.unitrends.com/UnitrendsBackup/s/article/000001150
Vendor Advisory
https://support.unitrends.com/UnitrendsBackup/s/article/000006002
Vendor Advisory
https://www.exploit-db.com/exploits/44297/
Exploit
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/45559/
Exploit
Third Party Advisory
VDB Entry
https://support.unitrends.com/UnitrendsBackup/s/article/000001150
Vendor Advisory
https://support.unitrends.com/UnitrendsBackup/s/article/000006002
Vendor Advisory
https://www.exploit-db.com/exploits/44297/
Exploit
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/45559/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:kaseya:unitrends_backup:*:*:*:*:*:*:*:*

Версия до 10.1 (исключая)

EPSS

Процентиль: 99%

0.70958

Высокий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-287

Связанные уязвимости

GHSA-743r-2x7m-hrm4