2 lines
2.9 KiB
JSON
2 lines
2.9 KiB
JSON
{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"support@hackerone.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ubnt:ucrm:*:*:*:*:*:*:*:*","matchCriteriaId":"469CD514-8882-406F-BEB2-ABAF78B04710","versionEndIncluding":"2.7.7","versionStartIncluding":"2.3.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Ubiquiti UCRM versions 2.3.0 to 2.7.7 allow an authenticated user to read arbitrary files in the local file system. Note that by default, the local file system is isolated in a docker container. Successful exploitation requires valid credentials to an account with \"Edit\" access to \"System Customization\"."},{"lang":"es","value":"Ubiquiti UCRM desde la versión 2.3.0 a la 2.7.7 permite que un usuario autenticado lea archivos arbitrarios en el sistema de archivos local. Por defecto, el sistema de archivos local está aislado en un contenedor de tipo docker. La explotación exitosa de esta vulnerabilidad requiere credenciales válidas para una cuenta con acceso \"Edit\" a \"System Customization\"."}],"id":"CVE-2017-0913","lastModified":"2026-06-17T00:58:31.020","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"LOW","cvssData":{"accessComplexity":"MEDIUM","accessVector":"LOCAL","authentication":"NONE","availabilityImpact":"NONE","baseScore":1.9,"confidentialityImpact":"PARTIAL","integrityImpact":"NONE","vectorString":"AV:L/AC:M/Au:N/C:P/I:N/A:N","version":"2.0"},"exploitabilityScore":3.4,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.0"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2018-07-03T21:29:00.247","references":[{"source":"support@hackerone.com","tags":["Vendor Advisory"],"url":"https://community.ubnt.com/t5/UCRM/New-UCRM-upgrades-available-2-8-2-and-2-9-0-beta3/td-p/2211814"},{"source":"support@hackerone.com","tags":["Third Party Advisory"],"url":"https://hackerone.com/reports/301406"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://community.ubnt.com/t5/UCRM/New-UCRM-upgrades-available-2-8-2-and-2-9-0-beta3/td-p/2211814"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://hackerone.com/reports/301406"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"}],"source":"nvd@nist.gov","type":"Primary"}]}
|