| Package | Affected versions | Patched versions |
|---|---|---|
| enterprise backup | ≤ 9.1.1 |
An attacker that has hijacked a Unitrends Enterprise Backup (before 9.1.2) web server session can leverage api/includes/users.php to change the password of the logged in account without knowing the current password. This allows for an account takeover.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free