CVE-2017-7284

Published: 2017-04-12T22:59Z

Last Modified: 2024-11-21T03:31Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

An attacker that has hijacked a Unitrends Enterprise Backup (before 9.1.2) web server session can leverage api/includes/users.php to change the password of the logged in account without knowing the current password. This allows for an account takeover. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt