CVE-2017-12479 - CVE House
Back to Database
Status published High CVE-2017-12479

It was discovered that an issue in the session logic...

Vulnerability Description

It was discovered that an issue in the session logic in Unitrends Backup (UB) before 10.0.0 allowed using the LOGDIR environment variable during a web session to elevate an existing low-privilege user to root privileges. A remote attacker with existing low-privilege credentials could then execute arbitrary commands with root privileges.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-12479

Credits & Attribution

No credits recorded in the NVD database.

References

More from kaseya

View All →
CVE-2021-43044
An issue was discovered in Kaseya Unitrends Backup Appliance before...
Critical 9.8
CVE-2021-43043
An issue was discovered in Kaseya Unitrends Backup Appliance before...
Medium 6.5
CVE-2021-43042
An issue was discovered in Kaseya Unitrends Backup Appliance before...
Critical 9.8
CVE-2021-43041
An issue was discovered in Kaseya Unitrends Backup Appliance before...
High 8.8
CVE-2021-43040
An issue was discovered in Kaseya Unitrends Backup Appliance before...
High 8.8

Affected Vendor

Affected Software

unitrends backup
Vulnerable Versions:
0

Timeline

Official Publish: August 7th, 2017
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.