CVE-2017-12479

CVE-2017-12479 – Unitrends Backup : Affects UB prior to 10.0.0. The issue is in session handling, where an attacker with existing low-privilege credentials can leverage the LOGDIR environment variable during a web session to elevate to root and execute arbitrary commands with root privileges. Thi...

PT-2017-12565

Name of the Vulnerable Software and Affected Versions Unitrends Backup versions prior to 10.0.0 Description An issue in the session logic allowed using the LOGDIR environment variable during a web session to elevate an existing low-privilege user to root privileges. A remote attacker with existin...

CVE-2017-12479: Undefined Security Weakness

It was discovered that an issue in the session logic in Unitrends Backup UB before 10.0.0 allowed using the LOGDIR environment variable during a web session to elevate an existing low-privilege user to root privileges. A remote attacker with existing low-privilege credentials could then execute...