critical9.8Public exploit code
CVE-2018-6329
It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing a remote attacker to…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Unitrends Enterprise Backup - bpserverd Privilege Escalation (Metasploit)2018-11-29 · local · linux · Verified
- Unitrends UEB 10.0 - Root Remote Code Execution2018-03-16 · remote · linux
Impact
It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing a remote attacker to place a privilege escalation exploit on the target system and subsequently execute arbitrary commands.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Unitrends | Backup | before 10.1.10 |
Weakness classification
References
- NVD record
- CVE.org record
- https://support.unitrends.com/UnitrendsBackup/s/article/000001150
- https://support.unitrends.com/UnitrendsBackup/s/article/000006003
- https://www.exploit-db.com/exploits/44297/
- https://www.exploit-db.com/exploits/45913/
- https://support.unitrends.com/UnitrendsBackup/s/article/000001150
- https://support.unitrends.com/UnitrendsBackup/s/article/000006003
- https://www.exploit-db.com/exploits/44297/
- https://www.exploit-db.com/exploits/45913/