CVE-2017-12479
Last modified
CVE-2017-12479 is a vulnerability of currently unknown severity. It was discovered that an issue in the session logic in Unitrends Backup (UB) before 10.0.0 allowed using the LOGDIR environment variable during a web session to elevate an existing low-privilege user to root privileges. A remote attacker with existing low-privilege credentials could then execute arbitrary commands with root privileges.. EPSS estimates a 11.81% chance of exploitation in the next 30 days.
Description
It was discovered that an issue in the session logic in Unitrends Backup (UB) before 10.0.0 allowed using the LOGDIR environment variable during a web session to elevate an existing low-privilege user to root privileges. A remote attacker with existing low-privilege credentials could then execute arbitrary commands with root privileges.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Kaseya | Unitrends Backup | <= 9.1 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-12479?
How severe is CVE-2017-12479?
How do I fix CVE-2017-12479?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-12473ccnl_ccntlv_bytes2pkt in CCN-lite allows context-dependent a…
- CVE-2017-12474The AP4_AtomSampleTable::GetSample function in Core/Ap4AtomS…
- CVE-2017-12475The AP4_Processor::Process function in Core/Ap4Processor.cpp…
- CVE-2017-12476The AP4_AvccAtom::InspectFields function in Core/Ap4AvccAtom…
- CVE-2017-12477It was discovered that the bpserverd proprietary protocol in…9.8
- CVE-2017-12478It was discovered that the api/storage web interface in Unit…9.8
- CVE-2017-1248IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vu…5.4
- CVE-2017-12480Sandboxie installer 5071703 has a DLL Hijacking or Unsafe DL…
- CVE-2017-12481The find_option function in option.cc in Ledger 3.1.1 allows…
- CVE-2017-12482The ledger::parse_date_mask_routine function in times.cc in …
- CVE-2017-12487A Remote Code Execution vulnerability in HPE Intelligent Man…
- CVE-2017-12488A Remote Code Execution vulnerability in HPE Intelligent Man…
Are you affected by CVE-2017-12479?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST