Auth bypass in Quest Netvault Backup

CVE-2018-1163

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Quest NetVault Backup 11.2.0.13. The specific flaw exists within JSON RPC Request handling. By setting the checksession parameter to a speci…

Vulnerability class: Broken Authentication

EPSS: 0.169 (96.6th percentile) — read the EPSS interpretation.

Affected products

Quest Netvault Backup — versions 11.2.0.13

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

zerodayinitiative.com/advisories/ZDI-18-006 (x_refsource_MISC)