Vulnerability · Published Apr 1, 2020 · Assigned by hackerone

CVE-2020-8144

High 8.4

In plain English

A high-severity path traversal in UniFi Video Controller (for Windows 7/8/10 x64). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).

Severity (CVSS NVD)8.4High

Exploit odds (30 days)0.7%top 44.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The UniFi Video Server v3.9.3 and prior (for Windows 7/8/10 x64) web interface Firmware Update functionality, under certain circumstances, does not validate firmware download destinations to ensure they are within the intended destination directory tree. It accepts a request with a URL to firmware update information. If the version field contains ..\ character sequences, the destination file path to save the firmware can be manipulated to be outside the intended destination directory tree. Fixed in UniFi Video Controller v3.10.3 and newer.

Affected products (as reported)

Vendor	Product	Versions
n/a	UniFi Video Controller (for Windows 7/8/10 x64)	v3.9.3 and prior are affectedFixed in v3.10.3 and newer

Weakness: CWE-22

References

https://community.ui.com/releases/Security-advisory-bulletin-006-006/3cf6264e-e0e6-4e26-a331-1d271f84673e x_refsource_CONFIRM