Arcserve Unified Data Protection Authentication Bypass Vulnerability

A vulnerability allowing authentication bypass has been identified in Arcserve Unified Data Protection (UDP) versions prior to 10.2. This flaw enables unauthenticated attackers to access protected functionalities or user accounts by manipulating request parameters or exploiting logic flaws to bypass login mechanisms. As a result, attackers can gain unauthorized access to administrator-level features.

Impact

Exploitation of this vulnerability allows unauthorized access to administrator-level functionalities, potentially leading to further exploitation of the application or its data.

Remediation

Users can upgrade to Arcserve UDP 10.2, which includes the necessary patches. For those using Arcserve UDP versions 8.0 through 10.1, patches are available and can be applied. Customers on unsupported versions (UDP 7.x and earlier) should urgently upgrade to UDP 10.2.