Privilege Escalation Vulnerability in Kaseya Unitrends Backup Appliance

CVE-2021-43038

What is CVE-2021-43038?

A vulnerability exists in Kaseya's Unitrends Backup Appliance prior to version 10.5.5, where the 'wguest' user account can exploit PostgreSQL trigger functions. This allows the execution of arbitrary commands, enabling attackers to elevate their privileges from the limited 'wguest' user to the more powerful 'postgres' user. This type of flaw poses significant risks as it can give unauthorized users access to critical data and system controls.

References