CVE-2017-7284

An attacker that has hijacked a Unitrends Enterprise Backup (before 9.1.2) web server session can leverage api/includes/users.php to change the password of the…

published April 12, 2017

CVSS
—
EPSS
3%
Percentile
85.5
In the wild
Unconfirmed
What it is

An attacker that has hijacked a Unitrends Enterprise Backup (before 9.1.2) web server session can leverage api/includes/users.php to change the password of the logged in account without knowing the current password. This allows for an account takeover.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02656 · 85.5th percentile
Published
2017-04-12T22:00Z
EPSS history
Timeline
  • 12 APR 22:00Z
    An attacker that has hijacked a Unitrends Enterprise Backup (before 9.1.2) web server session can leverage api/includes/users.php to change the password of the…
    cvelistv5