CVE-2019-5430 Cross-site request forgery in UniFi Video Server
Attackers can modify server configuration without user consent by tricking authenticated users into visiting malicious pages due to missing CSRF protection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-5430?
CVE-2019-5430 is a high-severity vulnerability in UniFi Video Server, published on 6 May 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In UniFi Video 3.10.0 and prior, due to the lack of CSRF protection, it is possible to abuse the Web API to make changes on the server configuration without the user consent, requiring the attacker to lure an authenticated user to access on attacker controlled page.
Weakness: CWE-352
Which versions are affected by CVE-2019-5430?
It affects 1 product.
Products include Ui Unifi Video.
How do I fix CVE-2019-5430?
No fix has been published for CVE-2019-5430 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-5430 being exploited?
There is no known exploitation of CVE-2019-5430 in the wild and no public exploit code.
Other vulnerabilities in UniFi Video Server
- CVE-2020-8144 Path traversal in UniFi Video Controller (for Windows 7/8/10 x64)
- CVE-2020-24755 Other in n/a
- CVE-2020-8146 Privilege escalation in UniFi Video Controller (for Windows 7/8/10 x64)
- CVE-2016-6914 Privilege escalation in n/a
- CVE-2020-8145 Missing authorization in UniFi Video Controller (for Windows 7/8/10 x64)
Sources
Also known as GHSA-fc4h-7x45-5wrw.