File Read Vulnerability in Kaseya Unitrends Backup Appliance
CVE-2021-43043

6.5MEDIUM

Key Information:

Vendor

Kaseya

Status
Unitrends Backup
Vendor
CVE Published:
6 December 2021

What is CVE-2021-43043?

A vulnerability exists in the Kaseya Unitrends Backup Appliance prior to version 10.5.5 that allows unauthorized access to sensitive files. Exploiting an insecure Sudo configuration, the apache user can read arbitrary files, including critical system files such as /etc/shadow. This could potentially lead to further system compromise, highlighting the need for securing Sudo permissions and regular system updates.

References

https://helpdesk.kaseya.com/hc/en-gb/articles/4412762258961
https://www.cyberonesecurity.com/blog/exploiting-kaseya-u...
https://www.cyberonesecurity.com/blog/exploiting-kaseya-u...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.