Ubiquiti Inc. · Report #140793
UniFi Video v3.2.2 (Windows) Local Privileges Escalation due to weak default install directory ACLs
Validstatus
highseverity
3upvotes
20 Dec 2017disclosed
Summary
The UniFi Video Windows installation v3.7.3 and prior create directories with insecure permission, allowing unprivileged users to modify UniFi Video files and consequently escalate privileges.
This vulnerability does affect all UniFi video versions up to and including 3.7.3 and is referenced by CVE-2016-6914.
The full public advisory can be found here: http://seclists.org/fulldisclosure/2017/Dec/83.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.