地图 / UniFi Video Server web interface admin user Firmware Update path traversal leading to local system compromise

UniFi Video Server web interface admin user Firmware Update path traversal leading to local system compromise

路径遍历 / 路径遍历 / #330051

厂商: Ubiquiti Inc.
严重程度: 中危 · CVSS 8.4
赏金: —
弱点: 路径遍历
研究员: @ajxchapman
披露日期: 2020-04-01
资产: UniFi Video Server
CVE: CVE-2020-8144

该报告还没有中文解读。

时间线

2018-03-26报告提交
2020-04-01公开披露

阅读 HackerOne 原文 ↗作者 @ajxchapman · 版权归作者与 Ubiquiti Inc. 所有

同类报告

Arbitrary file read via the UploadsRewriter when moving and issueGitLab · 2020-04-27 · $20,000 Arbitrary file read via the bulk imports UploadsPipelineGitLab · 2022-03-21 · $29,000 Misuse of an authentication cookie combined with a path traversal on app.starbucks.com permitted access to restricted dataStarbucks · 2020-06-16 Arbitrary file read during project importGitLab · 2021-05-24 · $16,000 Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handlingPortSwigger Web Security · 2026-06-14 · $5,000 Path traversal in filename in LINE Mac clientLY Corporation · 2020-07-31