CVE-2017-7284: High severity Unitrends Enterprise Backup vulnerability
An attacker that has hijacked a Unitrends Enterprise Backup (before 9.1.2) web server session can leverage api/includes/users.php to change the password of the logged in account without knowing the current password. This allows for an account takeover.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7284?
CVE-2017-7284 has a high severity rating as it allows for account takeover without knowledge of the current password.
How do I fix CVE-2017-7284?
To fix CVE-2017-7284, it's recommended to upgrade to Unitrends Enterprise Backup version 9.1.2 or later.
What type of vulnerability is CVE-2017-7284?
CVE-2017-7284 is an authentication vulnerability that allows session hijacking and account takeover.
Which versions of Unitrends Enterprise Backup are affected by CVE-2017-7284?
CVE-2017-7284 affects all versions of Unitrends Enterprise Backup prior to version 9.1.2.
What can attackers do with CVE-2017-7284?
Attackers can exploit CVE-2017-7284 to change the password of the logged-in account, leading to unauthorized access.