CVE-2020-8213 Information disclosure in Protect for UniFi Cloud Key Gen2 Plus
Unauthenticated attackers can enumerate valid usernames in UniFi Protect via timing and response code analysis, facilitating targeted attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-8213?
CVE-2020-8213 is a medium-severity vulnerability in Protect for UniFi Cloud Key Gen2 Plus, published on 30 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An information exposure vulnerability exists in UniFi Protect before v1.13.4-beta.5 that allowed unauthenticated attackers access to valid usernames for the UniFi Protect web application via HTTP response code and response timing.
Weakness: CWE-209
Which versions are affected by CVE-2020-8213?
It affects 1 product.
Products include Ui Unifi Protect.
How do I fix CVE-2020-8213?
No fix has been published for CVE-2020-8213 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-8213 being exploited?
There is no known exploitation of CVE-2020-8213 in the wild and no public exploit code.
Other vulnerabilities in Protect for UniFi Cloud Key Gen2 Plus
- CVE-2026-55115 Server-side request forgery in UniFi Protect Application
- CVE-2021-22943 A vulnerability found in UniFi Protect application V1.18.1 and earlier permits a malicious actor who has already gained access to a network
- CVE-2026-56841 SQL injection in UniFi Protect Application
- CVE-2026-21633 Auth bypass in UniFi Protect Application
- CVE-2021-22957 Cross-site request forgery in UniFi Protect application
Sources
Also known as GHSA-532p-r74j-rw26.