Vulnerability · Published Apr 1, 2020 · Assigned by hackerone
CVE-2020-8145
Medium 6.5
In plain English
A medium-severity security flaw in UniFi Video Controller (for Windows 7/8/10 x64). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Official description
The UniFi Video Server (Windows) web interface configuration restore functionality at the “backup” and “wizard” endpoints does not implement sufficient privilege checks. Low privileged users, belonging to the PUBLIC_GROUP or CUSTOM_GROUP groups, can access these endpoints and overwrite the current application configuration. This can be abused for various purposes, including adding new administrative users. Affected Products: UniFi Video Controller v3.9.3 (for Windows 7/8/10 x64) and prior. Fixed in UniFi Video Controller v3.9.6 and newer.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | UniFi Video Controller (for Windows 7/8/10 x64) | v3.9.3 and prior are affectedFixed in v3.9.6 and newer |