CVE-2017-7283 | BDVDB-2026-84467 Detail

Description#

An authenticated user of Unitrends Enterprise Backup before 9.1.2 can execute arbitrary OS commands by sending a specially crafted filename to the /api/restore/download-files endpoint, related to the downloadFiles function in api/includes/restore.php.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-2/
https://support.unitrends.com/UnitrendsBackup/s/article/ka640000000CcWBAA0/000005557?r=1

Exploit#

No public exploit known

History#

Version 12017-04-20Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.