PT-2021-23725 · Postgresql+1 · Postgresql+1

Rich Mirch · Published 2021-12-06 · Updated 2022-11-28 · CVE-2021-43036

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kaseya Unitrends Backup Appliance versions prior to 10.5.5

Description An issue was discovered in the Kaseya Unitrends Backup Appliance where the password for the PostgreSQL wguest account is weak.

Recommendations For versions prior to 10.5.5, update to version 10.5.5 or later to resolve the issue. As a temporary workaround, consider changing the password for the PostgreSQL wguest account to a stronger one until a patch is applied.

Exploit

Fix

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2021-43036

Affected Products

Kaseya Unitrends Backup Appliance

Postgresql

References · 8

• 🔥 https://cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-2 · Exploit
• 🔥 https://cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-1 · Exploit
• https://osv.dev/vulnerability/CVE-2021-43036 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43036 · Security Note
• https://helpdesk.kaseya.com/hc/en-gb/articles/4412762258961 · Vendor Advisory
• https://t.me/cvenotify/24272 · Telegram Post
• https://t.me/cvenotify/24254 · Telegram Post
• https://t.me/cibsecurity/33356 · Telegram Post