CRITICAL🇵🇱 Wersja polska

CVE-2021-43035

CVSS 9.8v3.1pub. 2021-12-06upd. 2024-11-21

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Two unauthenticated SQL injection vulnerabilities were discovered, allowing arbitrary SQL queries to be injected and executed under the postgres superuser account. Remote code execution was possible, leading to full access to the postgres user account.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Kaseya Unitrends Backup

    APP
    Kaseya
    10.0 – 10.5.5 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCESQLi
CWE
References

Related vulnerabilities

CVE-2021-40386CRITICAL9.8PL ✓same product

RCE w Kaseya Unitrends Client/Agent — zdalne wykonanie kodu

CVE-2021-43036CRITICAL9.8PL ✓same product

Słabe hasło konta PostgreSQL wguest w Kaseya Unitrends Backup

CVE-2021-43033CRITICAL9.8PL ✓same product

RCE jako root w Kaseya Unitrends Backup — command injection w bpserverd

CVE-2021-43042CRITICAL9.8PL ✓same product

Buffer overflow w Kaseya Unitrends Backup — zdalne wykonanie kodu bez uwierzytelnienia

CVE-2021-43044CRITICAL9.8PL ✓same product

Kaseya Unitrends Backup: słabe domyślne hasło SNMP (CWE-798)