Security Advisory

CVE-2017-7282

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2017-04-20 02:43:00

Last updated 2024-08-05 15:56:36

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

An issue was discovered in Unitrends Enterprise Backup before 9.1.1. The function downloadFile in api/includes/restore.php blindly accepts any filename passed to /api/restore/download as valid. This allows an authenticated attacker to read any file in the filesystem that the web server has access to, aka Local File Inclusion (LFI).

← Browse all CVEs View on cve.org ↗