Critical severity · published Mar 14, 2018
CVE-2018-6328
It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unauthenticated user to inject…
9.8
CVSS
64.4%
EPSS
No
On KEV
Description
It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unauthenticated user to inject arbitrary commands into its /api/hosts parameters using backquotes.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)64.4% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UB
Unitrends Backup · Kaseya
before 10.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-6328
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-6328
Vendor Advisory
https://support.unitrends.com/UnitrendsBackup/s/article/000001150
Vendor Advisory
https://support.unitrends.com/UnitrendsBackup/s/article/000006002
Exploit
https://www.exploit-db.com/exploits/44297/
Exploit
https://www.exploit-db.com/exploits/45559/
More from Unitrends Backup
9.8
CVE-2021-40386
Kaseya Unitrends Client/Agent through 10.5,5 allows remote attackers to execute arbitrary code
9.8
CVE-2021-43044
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5
9.8
CVE-2021-43042
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5
9.8
CVE-2021-43036
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5
9.8
CVE-2021-43035
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5