Unauthenticated SQL Injection Vulnerabilities in Kaseya Unitrends Backup Appliance

CVE-2021-43035

What is CVE-2021-43035?

A serious issue has been found in Kaseya's Unitrends Backup Appliance prior to version 10.5.5, involving two unauthenticated SQL injection vulnerabilities. These weaknesses enable malicious actors to inject arbitrary SQL commands that can be executed with PostgreSQL superuser privileges. This makes it possible for attackers to gain unauthorized access and can potentially lead to remote code execution, allowing for a full compromise of the PostgreSQL user account.

References