Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2018-6329: Unitrends Backup before 10.1.0 lets remote attackers run code
CVE-2018-6329 · published 8 years ago
Summary
A library used by Unitrends Backup can be tricked into bypassing its login check by sending specially crafted data to its database. This lets a remote attacker gain higher privileges and run any command on the server. Upgrade to version 10.1.0 or later and apply any available security patches.
What to do
- Update unitrends backup to version 10.1.10 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unitrends | backup |
< 10.1.10 cpe:2.3:a:unitrends:backup:*:*:*:*:*:*:*:* |
Original advisory text
It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing a remote attacker to place a privilege escalation exploit ...
It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing a remote attacker to place a privilege escalation exploit on the target system and subsequently execute arbitrary commands.
References
- https://support.unitrends.com/UnitrendsBackup/s/article/000001150 Vendor Advisory
- https://support.unitrends.com/UnitrendsBackup/s/article/000006003 Vendor Advisory
- https://www.exploit-db.com/exploits/44297/ Exploit Third Party Advisory VDB Entry
- https://www.exploit-db.com/exploits/45913/ Exploit Third Party Advisory VDB Entry
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-89SQL Injection
Timeline
Published14 Mar 2018
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2018-6329 · NVD
Track software like this
Free during beta