CVE-2017-7283: Input Validation
An authenticated user of Unitrends Enterprise Backup before 9.1.2 can execute arbitrary OS commands by sending a specially crafted filename to the /api/restore/download-files endpoint, related to the downloadFiles function in api/includes/restore.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7283?
CVE-2017-7283 is classified as a high severity vulnerability due to the potential for arbitrary OS command execution.
How do I fix CVE-2017-7283?
To address CVE-2017-7283, upgrade Unitrends Enterprise Backup to version 9.1.2 or later.
What impact does CVE-2017-7283 have on affected systems?
CVE-2017-7283 allows an authenticated user to execute arbitrary OS commands on the server, posing a significant security risk.
Which versions of Unitrends Enterprise Backup are affected by CVE-2017-7283?
CVE-2017-7283 affects Unitrends Enterprise Backup versions up to and including 9.1.1.
Who is vulnerable to exploiting CVE-2017-7283?
Authenticated users of Unitrends Enterprise Backup prior to version 9.1.2 can exploit CVE-2017-7283.