PT-2018-5140 · Ubiquiti · Ucrm

Published 2018-07-03 · Updated 2019-10-03 · CVE-2017-0913

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ubiquiti UCRM versions 2.3.0 through 2.7.7

Description The issue allows an authenticated user to read arbitrary files in the local file system. By default, the local file system is isolated in a docker container. Successful exploitation requires valid credentials to an account with "Edit" access to "System Customization".

Recommendations For Ubiquiti UCRM versions 2.3.0 through 2.7.7, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2017-0913

Affected Products

Ucrm

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-0913 · Security Note
• https://osv.dev/vulnerability/CVE-2017-0913 · Vendor Advisory
• https://community.ubnt.com/t5/UCRM/New-UCRM-upgrades-available-2-8-2-and-2-9-0-beta3/td-p/2211814 · Vendor Advisory
• https://hackerone.com/reports/301406 · Note