CVE-2023-28361

2023-05-1100:00:00

CWE-352

hackerone

www.cve.org

cross-site websocket hijacking

unifi os

confidential information

malicious webpage

update

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

26.7%

JSON

A Cross-site WebSocket Hijacking (CSWSH) vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to access certain confidential information by persuading a UniFi OS user to visit a malicious webpage.Affected Products:Cloud Key Gen2Cloud Key Gen2 PlusUNVRUNVR ProfessionalUDMUDM ProfessionalUDM SEUDRMitigation:Update affected products to UniFi OS 3.0.13 or later.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "UniFi OS",
    "versions": [
      {
        "version": "Fixed in UniFi OS 3.0.13 or later.",
        "status": "affected"
      }
    ]
  }
]