CVE-2017-7283

An authenticated user of Unitrends Enterprise Backup before 9.1.2 can execute arbitrary OS commands by sending a specially crafted filename to the /api/restore/download-files endpoint, related to the downloadFiles function in api/includes/restore.php.

Affected products

Unitrends Enterprise Backup

Unitrends Enterprise Backup

≤ 9.1.1

Fix

Available

CVSS 2.0

9.0 HIGH

CVSS 3.1

8.8 HIGH

EPSS

3.1% (87th percentile)

Weakness

CWE-20

NVD status

Modified

Published

2017-04-20