Sign-up

ID

VAR-201407-0508


CVE

CVE-2014-2227


TITLE

Ubiquiti Networks UniFi Video Vulnerabilities bypassing same-origin policy in cross-domain policy for default flash

Trust: 0.8

sources: JVNDB: JVNDB-2014-003575

DESCRIPTION

The default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Networks UniFi Video (formerly AirVision aka AirVision Controller) before 3.0.1 does not restrict access to the application, which allows remote attackers to bypass the Same Origin Policy via a crafted SWF file. UniFi Video is prone to a security-bypass vulnerability. An authenticated attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks. UniFi Video 2.1.3 is vulnerable; other versions may also be affected. Ubiquiti Networks UniFi Video (also known as AirVision or AirVision Controller) is a set of video surveillance system of Ubiquiti Networks in the United States. The vulnerability is caused by the program not restricting access to the application

Trust: 1.98

sources: NVD: CVE-2014-2227 // JVNDB: JVNDB-2014-003575 // BID: 68866 // VULHUB: VHN-70166

AFFECTED PRODUCTS

vendor:uimodel:unifi videoscope:lteversion:2.1.3

Trust: 1.0

vendor:ubiquitimodel:unifi videoscope:ltversion:3.0.1

Trust: 0.8

vendor:ubntmodel:unifi videoscope:eqversion:2.1.3

Trust: 0.6

vendor:ubiquitimodel:networks unifi videoscope:eqversion:2.1.3

Trust: 0.3

vendor:ubiquitimodel:networks unifi videoscope:neversion:3.0.1

Trust: 0.3

sources: BID: 68866 // JVNDB: JVNDB-2014-003575 // CNNVD: CNNVD-201407-622 // NVD: CVE-2014-2227

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-2227
value: MEDIUM

Trust: 1.0

NVD: CVE-2014-2227
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201407-622
value: MEDIUM

Trust: 0.6

VULHUB: VHN-70166
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2014-2227
severity: MEDIUM
baseScore: 6.0
vectorString: AV:N/AC:M/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 6.8
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-70166
severity: MEDIUM
baseScore: 6.0
vectorString: AV:N/AC:M/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 6.8
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-70166 // JVNDB: JVNDB-2014-003575 // CNNVD: CNNVD-201407-622 // NVD: CVE-2014-2227

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.9

sources: VULHUB: VHN-70166 // JVNDB: JVNDB-2014-003575 // NVD: CVE-2014-2227

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201407-622

TYPE

permissions and access control issues

Trust: 0.6

sources: CNNVD: CNNVD-201407-622

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-003575

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-70166

PATCH
title:UniFi Video 3.0.1 / UVC 3.0.2 / airCam 3.0.2 Releaseurl:http://community.ubnt.com/t5/UniFi-Video-Blog/UniFi-Video-3-0-1-UVC-3-0-2-airCam-3-0-2-Release/ba-p/792374
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2014-003575

EXTERNAL IDS
db:NVDid:CVE-2014-2227
Trust: 2.8
db:BIDid:68866
Trust: 2.0
db:JVNDBid:JVNDB-2014-003575
Trust: 0.8
db:CNNVDid:CNNVD-201407-622
Trust: 0.6
db:PACKETSTORMid:127617
Trust: 0.1
db:EXPLOIT-DBid:39268
Trust: 0.1
db:VULHUBid:VHN-70166
Trust: 0.1
sources:
            
            
            VULHUB: VHN-70166 // 
            
            
            
            BID: 68866 // 
            
            
            
            JVNDB: JVNDB-2014-003575 // 
            
            
            
            CNNVD: CNNVD-201407-622 // 
            
            
            
            NVD: CVE-2014-2227

REFERENCES
url:http://seclists.org/fulldisclosure/2014/jul/128
Trust: 2.0
url:http://sethsec.blogspot.com/2014/07/cve-2014-2227.html
Trust: 2.0
url:http://www.securityfocus.com/bid/68866
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2227
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-2227
Trust: 0.8
url:http://sethsec.blogspot.jp/2014/07/cve-2014-2227.html
Trust: 0.8
url:http://www.ubnt.com/enterprise/
Trust: 0.3
sources:
            
            
            VULHUB: VHN-70166 // 
            
            
            
            BID: 68866 // 
            
            
            
            JVNDB: JVNDB-2014-003575 // 
            
            
            
            CNNVD: CNNVD-201407-622 // 
            
            
            
            NVD: CVE-2014-2227

CREDITS
Seth Art
Trust: 0.3
sources:
            
            
            BID: 68866

SOURCES
db:VULHUBid:VHN-70166
db:BIDid:68866
db:JVNDBid:JVNDB-2014-003575
db:CNNVDid:CNNVD-201407-622
db:NVDid:CVE-2014-2227

LAST UPDATE DATE
2024-11-23T22:02:04.486000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-70166date:2019-06-10T00:00:00
db:BIDid:68866date:2014-07-23T00:00:00
db:JVNDBid:JVNDB-2014-003575date:2014-07-29T00:00:00
db:CNNVDid:CNNVD-201407-622date:2019-06-11T00:00:00
db:NVDid:CVE-2014-2227date:2024-11-21T02:05:52.980

SOURCES RELEASE DATE
db:VULHUBid:VHN-70166date:2014-07-25T00:00:00
db:BIDid:68866date:2014-07-23T00:00:00
db:JVNDBid:JVNDB-2014-003575date:2014-07-29T00:00:00
db:CNNVDid:CNNVD-201407-622date:2014-07-28T00:00:00
db:NVDid:CVE-2014-2227date:2014-07-25T19:55:03.847