Lucene search

HackeroneCVE-2021-22944

HistoryAug 31, 2021 - 5:15 p.m.

CVE-2021-22944

2021-08-3117:15:07

hackerone

web.nvd.nist.gov

cve-2021-22944

unifi protect

vulnerability

security

nvd

patch

view-only role

privilege escalation

CVSS2

7.7

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:S/C:C/I:C/A:C

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

Percentile

12.6%

JSON

A vulnerability found in UniFi Protect application V1.18.1 and earlier allows a malicious actor with a view-only role and network access to gain the same privileges as the owner of the UniFi Protect application. This vulnerability is fixed in UniFi Protect application V1.19.0 and later.

Affected configurations

Nvd

Vulners

Node

uiunifi_protectRange<1.19.0

VendorProductVersionCPE
uiunifi_protect*cpe:2.3:a:ui:unifi_protect:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ui	unifi_protect	*	cpe:2.3:a:ui:unifi_protect::::::::

CNA Affected

[
  {
    "product": "UniFi Protect application",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed on 1.19.0"
      }
    ]
  }
]

References

community.ui.com/releases/Security-Advisory-Bulletin-019-019/90a00abe-d6b6-43c6-92d4-0a0342f1506f

CVSS2

7.7

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:S/C:C/I:C/A:C

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2021-22944