PT-2014-4566 · Ubiquiti · Unifi Controller

Publicado 2014-07-29 · Atualizado 2019-06-10 · CVE-2014-2226

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ubiquiti UniFi Controller versions prior to 3.2.1

Description The issue allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors, as the administrative password hash is logged in syslog messages.

Recommendations For versions prior to 3.2.1, update to version 3.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to syslog messages to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2014-2226

Produtos afetados

Unifi Controller

Referências · 5

• http://securityfocus.com/bid/68869 · Nota
• http://sethsec.blogspot.com/2014/07/cve-2014-2226.html · Nota
• http://packetstormsecurity.com/files/127616/Ubiquiti-UbiFi-Controller-2.4.5-Password-Hash-Disclosure.html · Nota
• http://seclists.org/fulldisclosure/2014/Jul/127 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-2226 · Nota de Segurança