PT-2019-7914 · Bittorrent+1 · Qbittorrent+1

Published 2017-09-11 · Updated 2024-08-05 · CVE-2017-12778

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions qBittorrent version 3.3.15

Description The issue concerns the UI Lock feature, which can be bypassed by tampering with the config file. An attacker can gain unauthorized access to qBittorrent functions by modifying the locked attribute within the Locking stanza in the config file located at C:Users<username>RoamingqBittorrent. However, it is noted that this behavior is intended.

Recommendations For qBittorrent version 3.3.15, consider using alternative security measures, as the UI Lock feature can be bypassed by modifying the config file. Avoid relying solely on the UI Lock feature for security.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

ALT-PU-2017-2185

CVE-2017-12778

Affected Products

Alt Linux

Qbittorrent

References · 13

• 🔥 http://archive.is/eF2GR · Exploit
• 🔥 https://medium.com/@BaYinMin/cve-2017-12778-qbittorrent-ui-lock-authentication-bypass-30959ff55ada · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-12778 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12778 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-12778 · Security Note
• https://ubuntu.com/security/CVE-2017-12778 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12778 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12778 · Security Note
• https://errata.altlinux.org/ALT-PU-2017-2185 · Vendor Advisory
• https://github.com/qbittorrent/qBittorrent/wiki/I-forgot-my-UI-lock-password · Note
• https://medium.com/%40BaYinMin/cve-2017-12778-qbittorrent-ui-lock-authentication-bypass-30959ff55ada · Note
• https://packages.altlinux.org/ru/vuln/CVE-2017-12778 · Note
• http://qbittorrent.com · Note