CVEvulnerability
CVE-2018-6328
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2018-03-14
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-287
Description
It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unauthenticated user to inject arbitrary commands into its /api/hosts parameters using backquotes.
Affected configurations
• kaseya unitrends backup (< 10.1)
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://support.unitrends.com/UnitrendsBackup/s/article/000001150 Vendor Advisory
- https://support.unitrends.com/UnitrendsBackup/s/article/000006002 Vendor Advisory
- https://www.exploit-db.com/exploits/44297/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/45559/ Exploit, Third Party Advisory, VDB Entry
- https://support.unitrends.com/UnitrendsBackup/s/article/000001150 Vendor Advisory
- https://support.unitrends.com/UnitrendsBackup/s/article/000006002 Vendor Advisory
- https://www.exploit-db.com/exploits/44297/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/45559/ Exploit, Third Party Advisory, VDB Entry