CVE-2017-7284

CVE-2017-7284 describes a critical authentication bypass vulnerability affecting Unitrends Enterprise Backup versions prior to 9.1.2. An authenticated attacker who has hijacked a web server session can exploit a flaw in the api/includes/users.php script to change the password of the logged-in account without needing the current password, leading to full account takeover. This vulnerability carries a high CVSS score of 8.8, indicating a network-based attack with low complexity and high impact on confidentiality, integrity, and availability. While no public exploit code or active exploitation has been observed, and community discussion is minimal, the potential for unauthorized access remains significant for unpatched systems.