Skip to content
OpenAdvisories
High WID-SEC-2023-3031 3 CVEs

Arcserve Unified Data Protection: Mehrere Schwachstellen

Published Nov 29, 2023 · Updated Nov 30, 2023 · Revision 2 · de-DE

Vendor: Arcserve Product: Unified Data Protection < 9.2 Platform: Linux Platform: Windows

Summary

Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Arcserve Unified Data Protection ausnutzen, um beliebigen Code auszuführen, Dateien zu manipulieren oder Sicherheitsmaßnahmen zu umgehen.

Product

Arcserve UDP (Unified Data Protection) ist eine Lösung für die Datensicherung und -wiederherstellung.

Vulnerabilities 3

  • Critical 9.8
    CVE-2023-41998 EPSS 15%

    Arcserve UDP Unauthenticated RCE

    Arcserve UDP prior to 9.2 contained a vulnerability in the com.ca.arcflash.rps.webservice.RPSService4CPMImpl interface. A routine exists that allows an attacker to upload and execute arbitrary files.

    Arcserve Arcserve UDP
  • Critical 9.8
    CVE-2023-41999

    Arcserve UDP Management Authentication Bypass

    An authentication bypass exists in Arcserve UDP prior to version 9.2. An unauthenticated, remote attacker can obtain a valid authentication identifier that allows them to authenticate to the management console and perform tasks that require authentication.

    Arcserve Arcserve UDP
  • Critical 9.8
    CVE-2023-42000

    Arcserve UDP Agent Unauthenticated Path Traversal File Upload

    Arcserve UDP prior to 9.2 contains a path traversal vulnerability in com.ca.arcflash.ui.server.servlet.FileHandlingServlet.doUpload(). An unauthenticated remote attacker can exploit it to upload arbitrary files to any location on the file system where the UDP…

    Arcserve Arcserve UDP

Revision history

  1. #2

    Anpassung im Text

  2. #1

    Initiale Fassung

References