It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing a remote attacker to place a privilege escalation exploit on the target system and subsequently execute arbitrary commands.
References
| Link | Resource |
|---|---|
| https://support.unitrends.com/UnitrendsBackup/s/article/000001150 | Vendor Advisory |
| https://support.unitrends.com/UnitrendsBackup/s/article/000006003 | Vendor Advisory |
| https://www.exploit-db.com/exploits/44297/ | Exploit Third Party Advisory VDB Entry |
| https://www.exploit-db.com/exploits/45913/ | Exploit Third Party Advisory VDB Entry |
| https://support.unitrends.com/UnitrendsBackup/s/article/000001150 | Vendor Advisory |
| https://support.unitrends.com/UnitrendsBackup/s/article/000006003 | Vendor Advisory |
| https://www.exploit-db.com/exploits/44297/ | Exploit Third Party Advisory VDB Entry |
| https://www.exploit-db.com/exploits/45913/ | Exploit Third Party Advisory VDB Entry |
Configurations
History
21 Nov 2024, 04:10
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://support.unitrends.com/UnitrendsBackup/s/article/000001150 - Vendor Advisory | |
| References | () https://support.unitrends.com/UnitrendsBackup/s/article/000006003 - Vendor Advisory | |
| References | () https://www.exploit-db.com/exploits/44297/ - Exploit, Third Party Advisory, VDB Entry | |
| References | () https://www.exploit-db.com/exploits/45913/ - Exploit, Third Party Advisory, VDB Entry |
Information
Published : 2018-03-14 19:29
Updated : 2024-11-21 04:10
NVD link : CVE-2018-6329
Mitre link : CVE-2018-6329
CVE.ORG link : CVE-2018-6329
JSON object : View
Products Affected
unitrends
- backup
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')