Log in Start free

Vulnerability · Published May 11, 2023 · Assigned by hackerone

CVE-2023-28361

Medium 6.5

In plain English

A medium-severity cross-site request forgery in UniFi OS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 77.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A Cross-site WebSocket Hijacking (CSWSH) vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to access certain confidential information by persuading a UniFi OS user to visit a malicious webpage.Affected Products:Cloud Key Gen2Cloud Key Gen2 PlusUNVRUNVR ProfessionalUDMUDM ProfessionalUDM SEUDRMitigation:Update affected products to UniFi OS 3.0.13 or later.

Affected products (as reported)

VendorProductVersions
n/a UniFi OS Fixed in UniFi OS 3.0.13 or later.

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References