Session Logic Vulnerability in Unitrends Backup by Unitrends
CVE-2017-12479

8.8HIGH

Key Information:

Vendor

Kaseya

Status
Unitrends Backup
Vendor
CVE Published:
7 August 2017

What is CVE-2017-12479?

A security flaw was identified in the session logic of Unitrends Backup prior to version 10.0.0, allowing attackers to leverage the LOGDIR environment variable in a web session. This flaw enables users with low privileges to escalate their access to root privileges. Consequently, a remote attacker with valid low-privilege credentials could execute arbitrary commands with elevated permissions, posing a significant security risk.

References

https://support.unitrends.com/UnitrendsBackup/s/article/0...
x_refsource_CONFIRM

EPSS Score

13% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.