FKIE_CVE-2023-28361

Vulnerability from fkie_nvd - Published: 2023-05-11 22:15 - Updated: 2026-06-17 05:47
Severity
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
A Cross-site WebSocket Hijacking (CSWSH) vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to access certain confidential information by persuading a UniFi OS user to visit a malicious webpage.Affected Products:Cloud Key Gen2Cloud Key Gen2 PlusUNVRUNVR ProfessionalUDMUDM ProfessionalUDM SEUDRMitigation:Update affected products to UniFi OS 3.0.13 or later.
References
support@hackerone.comhttps://community.ui.com/releases/Security-Advisory-Bulletin-030-030/f9de9e65-585f-4c66-81e9-5d8f54ba66ddVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://community.ui.com/releases/Security-Advisory-Bulletin-030-030/f9de9e65-585f-4c66-81e9-5d8f54ba66ddVendor Advisory
Impacted products
Vendor Product Version
uni unifi_os *
uni cloud_key_gen2 -
uni cloud_key_gen2_plus -
uni ubiquiti_networks_unifi_dream_machine -
uni ubiquiti_networks_unifi_dream_machine_professional -
uni ubiquiti_networks_unifi_dream_machine_se -
uni unifi_dream_router -
uni unifi_protect_network_video_recorder -
uni unifi_protect_network_video_recorder_professional -
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "UniFi OS",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in UniFi OS 3.0.13 or later."
            }
          ]
        }
      ],
      "source": "support@hackerone.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:uni:unifi_os:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "484887CC-286A-4C59-854A-06616BF3198B",
              "versionEndExcluding": "3.0.13",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:uni:cloud_key_gen2:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "48EFCCAA-76C0-417B-BCED-BB6C9D0CBE8B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:uni:cloud_key_gen2_plus:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1F171730-7AD1-46B3-ADAF-27BD69E7CC88",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:uni:ubiquiti_networks_unifi_dream_machine:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3BF09341-2DD2-4DCF-AEEA-67A6AEF2F0C5",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:uni:ubiquiti_networks_unifi_dream_machine_professional:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F8E72337-FAB2-4AB3-A8F8-7D32A1CEB17A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:uni:ubiquiti_networks_unifi_dream_machine_se:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED78B144-E2FE-4648-BAD9-5079C0FB6255",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:uni:unifi_dream_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8A6CDD1F-DA20-4199-8D2D-60066D83D538",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:uni:unifi_protect_network_video_recorder:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "27F9EEC7-3D49-4FB0-8CD0-94CAB5651DE0",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:uni:unifi_protect_network_video_recorder_professional:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E263DAE-C5DB-4642-9CA9-B56C098C8A1E",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Cross-site WebSocket Hijacking (CSWSH) vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to access certain confidential information by persuading a UniFi OS user to visit a malicious webpage.Affected Products:Cloud Key Gen2Cloud Key Gen2 PlusUNVRUNVR ProfessionalUDMUDM ProfessionalUDM SEUDRMitigation:Update affected products to UniFi OS 3.0.13 or later."
    }
  ],
  "id": "CVE-2023-28361",
  "lastModified": "2026-06-17T05:47:32.797",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-28361",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-01-27T16:43:36.396524Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2023-05-11T22:15:10.187",
  "references": [
    {
      "source": "support@hackerone.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://community.ui.com/releases/Security-Advisory-Bulletin-030-030/f9de9e65-585f-4c66-81e9-5d8f54ba66dd"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://community.ui.com/releases/Security-Advisory-Bulletin-030-030/f9de9e65-585f-4c66-81e9-5d8f54ba66dd"
    }
  ],
  "sourceIdentifier": "support@hackerone.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "support@hackerone.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.