Description
It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unauthenticated user to inject arbitrary commands into its /api/hosts parameters using backquotes.
Metrics
CVSS 3.0 9.8/10
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- https://support.unitrends.com/UnitrendsBackup/s/article/000001150Vendor Advisory
- https://support.unitrends.com/UnitrendsBackup/s/article/000006002Vendor Advisory
- https://www.exploit-db.com/exploits/44297/Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/45559/Exploit, Third Party Advisory, VDB Entry
- https://support.unitrends.com/UnitrendsBackup/s/article/000001150Vendor Advisory
- https://support.unitrends.com/UnitrendsBackup/s/article/000006002Vendor Advisory
- https://www.exploit-db.com/exploits/44297/Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/45559/Exploit, Third Party Advisory, VDB Entry
Timeline
- Published
- Mar 14, 2018
- Last modified
- Jun 17, 2026
- NVD status
- Modified