CVE-2018-6329

Опубликовано: 14 мар. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Высокий

Описание

It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing a remote attacker to place a privilege escalation exploit on the target system and subsequently execute arbitrary commands.

Ссылки

https://support.unitrends.com/UnitrendsBackup/s/article/000001150
Vendor Advisory
https://support.unitrends.com/UnitrendsBackup/s/article/000006003
Vendor Advisory
https://www.exploit-db.com/exploits/44297/
Exploit
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/45913/
Exploit
Third Party Advisory
VDB Entry
https://support.unitrends.com/UnitrendsBackup/s/article/000001150
Vendor Advisory
https://support.unitrends.com/UnitrendsBackup/s/article/000006003
Vendor Advisory
https://www.exploit-db.com/exploits/44297/
Exploit
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/45913/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:unitrends:backup:*:*:*:*:*:*:*:*

Версия до 10.1.10 (исключая)

EPSS

Процентиль: 99%

0.78992

Высокий

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-7xp6-hf5v-p7w5