CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 5.5. Exploitation may require the attacker to be authenticated.
CVE
CVE-2017-7282
Severity
MEDIUM
CVSS
5.5
EPSS
4.28%
Original NVD Description
An issue was discovered in Unitrends Enterprise Backup before 9.1.1. The function downloadFile in api/includes/restore.php blindly accepts any filename passed to /api/restore/download as valid. This allows an authenticated attacker to read any file in the filesystem that the web server has access to, aka Local File Inclusion (LFI).
Related CVEs
Other vulnerabilities affecting the same vendor(s)