PT-2018-5140 · Ubiquiti · Ucrm

Publicado 2018-07-03 · Atualizado 2019-10-03 · CVE-2017-0913

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Média

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ubiquiti UCRM versions 2.3.0 through 2.7.7

Description The issue allows an authenticated user to read arbitrary files in the local file system. By default, the local file system is isolated in a docker container. Successful exploitation requires valid credentials to an account with "Edit" access to "System Customization".

Recommendations For Ubiquiti UCRM versions 2.3.0 through 2.7.7, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2017-0913

Produtos afetados

Ucrm

Referências · 4

• https://hackerone.com/reports/301406 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-0913 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-0913 · Aviso do Fabricante
• https://community.ubnt.com/t5/UCRM/New-UCRM-upgrades-available-2-8-2-and-2-9-0-beta3/td-p/2211814 · Aviso do Fabricante