Lucene search

[email protected]CVE-2019-16889

HistorySep 25, 2019 - 8:15 p.m.

CVE-2019-16889

2019-09-2520:15:11

CWE-770

[email protected]

web.nvd.nist.gov

ubiquiti edgemax

cve-2019-16889

denial of service

disk consumption

beaker.session.id

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 High

AI Score

Confidence

High

7.8 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.005 Low

EPSS

Percentile

77.4%

JSON

Ubiquiti EdgeMAX devices before 2.0.3 allow remote attackers to cause a denial of service (disk consumption) because *.cache files in /var/run/beaker/container_file/ are created when providing a valid length payload of 249 characters or fewer to the beaker.session.id cookie in a GET header. The attacker can use a long series of unique session IDs.

Affected configurations

NVD

Node

uier-x_firmwareRange<2.0.3

AND

uier-xMatch-

Node

uier-x-sfp_firmwareRange<2.0.3

AND

uier-x-sfpMatch-

Node

uiep-r6_firmwareRange<2.0.3

AND

uiep-r6Match-

Node

uierlite-3_firmwareRange<2.0.3

AND

uierlite-3Match-

Node

uierpoe-5Match-

AND

uierpoe-5_firmwareRange<2.0.3

Node

uier-8Match-

AND

uier-8_firmwareRange<2.0.3

Node

uierpro-8Match-

AND

uierpro-8_firmwareRange<2.0.3

Node

uiep-r8Match-

AND

uiep-r8_firmwareRange<2.0.3

Node

uier-4Match-

AND

uier-4_firmwareRange<2.0.3

Node

uier-6pMatch-

AND

uier-6p_firmwareRange<2.0.3

Node

uier-12Match-

AND

uier-12_firmwareRange<2.0.3

Node

uier-8-xgMatch-

AND

uier-8-xg_firmwareRange<2.0.3

CPENameOperatorVersion
ui:er-x_firmwareui er-x firmwarelt2.0.3

CPE	Name	Operator	Version
ui:er-x_firmware	ui er-x firmware	lt	2.0.3

References

community.ui.com/releases/New-EdgeRouter-firmware-2-0-3-has-been-released-2-0-3/e8badd28-a112-4269-9fb6-ffe3fc0e1643

hackerone.com/reports/406614

mjlanders.com/2019/07/28/resource-consumption-dos-on-edgemax-v1-10-6/

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 High

AI Score

Confidence

High

7.8 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.005 Low

EPSS

Percentile

77.4%

JSON

Related for CVE-2019-16889

openvas1 nvd1 githubexploit1 cvelist1 prion1