CVE-2018-6328 | BDVDB-2026-97884 Detail

Description#

It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unauthenticated user to inject arbitrary commands into its /api/hosts parameters using backquotes.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://www.exploit-db.com/exploits/45559/
https://support.unitrends.com/UnitrendsBackup/s/article/000006002
https://www.exploit-db.com/exploits/44297/
https://support.unitrends.com/UnitrendsBackup/s/article/000001150

Exploit#

https://www.exploit-db.com/exploits/45559/
https://www.exploit-db.com/exploits/44297/

History#

Version 12018-03-14Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.