ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2017-7282

PoC —
CVSS 3.0
5.5 medium
EPSS
4%p91
Published
()
Modified
Description

An issue was discovered in Unitrends Enterprise Backup before 9.1.1. The function downloadFile in api/includes/restore.php blindly accepts any filename passed to /api/restore/download as valid. This allows an authenticated attacker to read any file in the filesystem that the web server has access to, aka Local File Inclusion (LFI).

Vendors
unitrends
Products
enterprise backup
Weakness
CWE-200
Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
NVD CVE.org GitHub PoCs EPSS (4.3%)

In the news

No ingested article mentions this CVE yet.