CVE-2017-12478

🗓️ 07 Aug 2017 15:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 122 Views🌐 WEB

Unitrends Backup (UB) before 10.0.0 has authentication bypass vulnerabilit

Reporter	Title	Published	Views	Family All 21
zdt	Unitrends UEB 9.1 - Authentication Bypass / Remote Command Execution Exploit	6 Oct 201700:00	–	zdt
zdt	Unitrends UEB 9 HTTP API/Storage Remote Root Exploit	22 Oct 201700:00	–	zdt
zdt	Unitrends UEB HTTP API Remote Code Execution Exploit	6 Oct 201800:00	–	zdt
BDU FSTEC	The vulnerability in the web interface of the API/Storage component of the Unitrends Backup tool allows a perpetrator to bypass authentication procedures or execute arbitrary commands with root privileges.	22 Sep 201700:00	–	bdu_fstec
Circl	CVE-2017-12478	8 Aug 201700:00	–	circl
CNVD	Unitrends Backup Authorization Issues Vulnerability (CNVD-2017-28329)	14 Aug 201700:00	–	cnvd
Check Point Advisories	Kaseya Unitrends Backup Remote Code Execution (CVE-2017-12478)	17 May 202200:00	–	checkpoint_advisories
Cvelist	CVE-2017-12478	7 Aug 201715:00	–	cvelist
Exploit DB	Unitrends UEB 9.1 - Authentication Bypass / Remote Command Execution	8 Aug 201700:00	–	exploitdb
Exploit DB	Unitrends UEB 9 - http api/storage Remote Root (Metasploit)	23 Oct 201700:00	–	exploitdb

NVD

Node

kaseya unitrends_backupRange<10.0

Source	Link
exploit-db	www.exploit-db.com/exploits/45559/
support	www.support.unitrends.com/UnitrendsBackup/s/article/000005756
exploit-db	www.exploit-db.com/exploits/43030/

Parameter	Position	Path	Description	CWE
auth	request body	/api/storage	Unauthenticated parameter validation flaw allowing SQLi-based auth bypass and command injection to achieve root RCE via POST to /api/storage.	CWE-287
type	request body	/api/storage	Unauthenticated parameter validation flaw allowing SQLi-based auth bypass and command injection to achieve root RCE via POST to /api/storage.	CWE-287
name	request body	/api/storage	Unauthenticated parameter validation flaw allowing SQLi-based auth bypass and command injection to achieve root RCE via POST to /api/storage.	CWE-287
usage	request body	/api/storage	Unauthenticated parameter validation flaw allowing SQLi-based auth bypass and command injection to achieve root RCE via POST to /api/storage.	CWE-287
properties	request body	/api/storage	Unauthenticated parameter validation flaw allowing SQLi-based auth bypass and command injection to achieve root RCE via POST to /api/storage.	CWE-287
hostname	request body	/api/storage	Unauthenticated parameter validation flaw allowing SQLi-based auth bypass and command injection to achieve root RCE via POST to /api/storage.	CWE-287
port	request body	/api/storage	Unauthenticated parameter validation flaw allowing SQLi-based auth bypass and command injection to achieve root RCE via POST to /api/storage.	CWE-287
protocol	request body	/api/storage	Unauthenticated parameter validation flaw allowing SQLi-based auth bypass and command injection to achieve root RCE via POST to /api/storage.	CWE-287
share_name	request body	/api/storage	Unauthenticated parameter validation flaw allowing SQLi-based auth bypass and command injection to achieve root RCE via POST to /api/storage.	CWE-287
username	request body	/api/storage	Unauthenticated parameter validation flaw allowing SQLi-based auth bypass and command injection to achieve root RCE via POST to /api/storage.	CWE-287

17 Jun 2026 01:03Current

9.8High risk

Vulners AI Score9.8

CVSS 3.19.8

CVSS 210

EPSS0.78269

CWE-287