CVE-2017-0913

Ubiquiti UCRM versions 2.3.0 to 2.7.7 allow an authenticated user to read arbitrary files in the local file system. Note that by default, the local file system is isolated in a docker container. Successful exploitation requires valid credentials to an account with "Edit" access to "System Customization".

CVSS v3 4.7 MEDIUM
CVSS v2.0 1.9 LOW

4.7^/10

CVSS v3 : MEDIUM

Vector : AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

1.9^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://community.ubnt.com/t5/UCRM/New-UCRM-upgrades-available-2-8-2-and-2-9-0-beta3/td-p/2211814	Vendor Advisory
https://hackerone.com/reports/301406	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ubnt:ucrm:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-07-03 21:29

Updated : 2019-10-03 00:03

NVD link : CVE-2017-0913

Mitre link : CVE-2017-0913

CVE.ORG link : CVE-2017-0913

JSON object : View

Products Affected

ubnt

ucrm

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2017-0913", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 1.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.0}]}, "published": "2018-07-03T21:29:00.247", "references": [{"url": "https://community.ubnt.com/t5/UCRM/New-UCRM-upgrades-available-2-8-2-and-2-9-0-beta3/td-p/2211814", "tags": ["Vendor Advisory"], "source": "support@hackerone.com"}, {"url": "https://hackerone.com/reports/301406", "tags": ["Third Party Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Ubiquiti UCRM versions 2.3.0 to 2.7.7 allow an authenticated user to read arbitrary files in the local file system. Note that by default, the local file system is isolated in a docker container. Successful exploitation requires valid credentials to an account with \"Edit\" access to \"System Customization\"."}, {"lang": "es", "value": "Ubiquiti UCRM desde la versi\u00f3n 2.3.0 a la 2.7.7 permite que un usuario autenticado lea archivos arbitrarios en el sistema de archivos local. Por defecto, el sistema de archivos local est\u00e1 aislado en un contenedor de tipo docker. La explotaci\u00f3n exitosa de esta vulnerabilidad requiere credenciales v\u00e1lidas para una cuenta con acceso \"Edit\" a \"System Customization\"."}], "lastModified": "2019-10-03T00:03:26.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ubnt:ucrm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "469CD514-8882-406F-BEB2-ABAF78B04710", "versionEndIncluding": "2.7.7", "versionStartIncluding": "2.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}