CVE-2017-7282 An issue was discovered in Unitrends Enterprise Backup before 9.1.1. The function downloadFile in api/includes/restore.php blindly accepts any filename passed to /api/restore/download as valid. This a...
MediumCVSS 5.5
EPSS 4.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in Unitrends Enterprise Backup before 9.1.1. The function downloadFile in api/includes/restore.php blindly accepts any filename passed to /api/restore/download as valid. This allows an authenticated attacker to read any file in the filesystem that the web server has access to, aka Local File Inclusion (LFI).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| unitrends enterprise backup | <= 9.1 | No fix listed |
References
- rhinosecuritylabs.com exploit third-party-advisory
- support.unitrends.com vendor-advisory