Description
Arcserve Unified Data Protection（UDP）是Arcserve公司推出的综合性数据保护解决方案，提供备份、灾难恢复和数据复制功能，支持物理、虚拟和云环境的统一管理。该产品采用集中式管理架构，具备重复数据删除、快照备份、远程复制等核心功能，广泛应用于金融、政府、医疗、制造等行业的数据中心。Arcserve UDP /management/wizardLogin 接口存在权限绕过漏洞，攻击者可绕过身份验证获取系统管理权限。
Arcserve Unified Data Protection /management/wizardLogin 权限绕过漏洞（CVE-2024-0799）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-0799
https://support.arcserve.com/s/article/Critical-vulnerability-alert-Arcserve-Unified-Data-Protection-UDP-Security-Fix-update-CVE-2024-0799-CVE-2024-0800-CVE-2024-0801?language=en_US
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0799.yaml
https://www.sentinelone.com/vulnerability-database/cve-2024-0799/
https://www.tenable.com/security/research/tra-2024-07
https://digital.nhs.uk/cyber-alerts/2024/cc-4487
https://www.helpnetsecurity.com/2024/03/14/cve-2024-0799-cve-2024-0800/