CVE-2017-7282

An issue was discovered in Unitrends Enterprise Backup before 9.1.1

published April 20, 2017

CVSS
—
EPSS
4%
Percentile
91.0
In the wild
Unconfirmed
What it is

An issue was discovered in Unitrends Enterprise Backup before 9.1.1. The function downloadFile in api/includes/restore.php blindly accepts any filename passed to /api/restore/download as valid. This allows an authenticated attacker to read any file in the filesystem that the web server has access to, aka Local File Inclusion (LFI).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04281 · 91.0th percentile
Published
2017-04-20T02:43Z
EPSS history
Timeline
  • 20 APR 02:43Z
    An issue was discovered in Unitrends Enterprise Backup before 9.1.1
    cvelistv5