PT-2019-7914 · Bittorrent+1 · Qbittorrent+1

CVE-2017-12778 · Publicado 2017-09-11 · Atualizado 2024-08-05

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions qBittorrent version 3.3.15

Description The issue concerns the UI Lock feature, which can be bypassed by tampering with the config file. An attacker can gain unauthorized access to qBittorrent functions by modifying the locked attribute within the Locking stanza in the config file located at C:Users<username>RoamingqBittorrent. However, it is noted that this behavior is intended.

Recommendations For qBittorrent version 3.3.15, consider using alternative security measures, as the UI Lock feature can be bypassed by modifying the config file. Avoid relying solely on the UI Lock feature for security.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

ALT-PU-2017-2185

CVE-2017-12778

Produtos afetados

Alt Linux

Qbittorrent

Referências · 13

• 🔥 http://archive.is/eF2GR · Exploit
• 🔥 https://medium.com/@BaYinMin/cve-2017-12778-qbittorrent-ui-lock-authentication-bypass-30959ff55ada · Exploit
• https://github.com/qbittorrent/qBittorrent/wiki/I-forgot-my-UI-lock-password · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-12778 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12778 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2017-12778 · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-12778 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-12778 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12778 · Nota de Segurança
• https://medium.com/%40BaYinMin/cve-2017-12778-qbittorrent-ui-lock-authentication-bypass-30959ff55ada · Nota
• https://packages.altlinux.org/ru/vuln/CVE-2017-12778 · Nota
• http://qbittorrent.com · Nota
• https://errata.altlinux.org/ALT-PU-2017-2185 · Aviso do Fabricante