vulnwire
5.5med

CVE-2017-7282

An issue was discovered in Unitrends Enterprise Backup before 9.1.1.

Published 9 y ago · modified 4 mo ago · JSON

CVSS
5.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.3%
percentile 91%
Public exploits
0
none known

An issue was discovered in Unitrends Enterprise Backup before 9.1.1. The function downloadFile in api/includes/restore.php blindly accepts any filename passed to /api/restore/download as valid. This allows an authenticated attacker to read any file in the filesystem that the web server has access to, aka Local File Inclusion (LFI).

Exploit prediction (EPSS)

4.28% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.05.5CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
NVD2.07.1AV:N/AC:M/Au:N/C:C/I:N/A:N

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

  • support.unitrends.com /UnitrendsBackup/s/article/ka640000000CcWGAA0/000005558?r=1 · x_refsource_MISC, x_transferred
  • rhinosecuritylabs.com /research/remote-code-execution-bug-hunting-chapter-2/ · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.