Vulnerability Description
The default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Networks UniFi Video (formerly AirVision aka AirVision Controller) before 3.0.1 does not restrict access to the application, which allows remote attackers to bypass the Same Origin Policy via a crafted SWF file.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ui | Unifi Video | <= 2.1.3 |
Related Weaknesses (CWE)
References
- http://seclists.org/fulldisclosure/2014/Jul/128Exploit
- http://sethsec.blogspot.com/2014/07/cve-2014-2227.htmlExploit
- http://www.securityfocus.com/bid/68866Exploit
- http://seclists.org/fulldisclosure/2014/Jul/128Exploit
- http://sethsec.blogspot.com/2014/07/cve-2014-2227.htmlExploit
- http://www.securityfocus.com/bid/68866Exploit
FAQ
What is CVE-2014-2227?
CVE-2014-2227 is a vulnerability with a CVSS score of 6.0 (MEDIUM). The default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Networks UniFi Video (formerly AirVision aka AirVision Controller) before 3.0.1 does not restrict access to the application, which a...
How severe is CVE-2014-2227?
CVE-2014-2227 has been rated MEDIUM with a CVSS base score of 6.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-2227?
Check the references section above for vendor advisories and patch information. Affected products include: Ui Unifi Video.