Vulnerability Details CVE-2017-7284
An attacker that has hijacked a Unitrends Enterprise Backup (before 9.1.2) web server session can leverage api/includes/users.php to change the password of the logged in account without knowing the current password. This allows for an account takeover.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.038
EPSS Ranking 87.6%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 6.5
References
Products affected by CVE-2017-7284
-
cpe:2.3:a:unitrends:enterprise_backup:7.3.0
-
cpe:2.3:a:unitrends:enterprise_backup:8.2.0-8
-
cpe:2.3:a:unitrends:enterprise_backup:9.1
-
cpe:2.3:a:unitrends:enterprise_backup:9.1.1