{
  "schema_version": "1.4.0",
  "id": "GHSA-hmwc-fhf2-67jg",
  "modified": "2022-05-17T19:57:26Z",
  "published": "2022-05-17T19:57:26Z",
  "aliases": [
    "CVE-2014-2225"
  ],
  "details": "Multiple cross-site request forgery (CSRF) vulnerabilities in Ubiquiti Networks UniFi Controller before 3.2.1 allow remote attackers to hijack the authentication of administrators for requests that (1) create a new admin user via a request to api/add/admin; (2) have unspecified impact via a request to api/add/wlanconf; change the guest (3) password, (4) authentication method, or (5) restricted subnets via a request to api/set/setting/guest_access; (6) block, (7) unblock, or (8) reconnect users by MAC address via a request to api/cmd/stamgr; change the syslog (9) server or (10) port via a request to api/set/setting/rsyslogd; (11) have unspecified impact via a request to api/set/setting/smtp; change the syslog (12) server, (13) port, or (14) authentication settings via a request to api/cmd/cfgmgr; or (15) change the Unifi Controller name via a request to api/set/setting/identity.",
  "severity": [],
  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2225"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2014/Jul/126"
    },
    {
      "type": "WEB",
      "url": "http://sethsec.blogspot.com/2014/07/cve-2014-2225.html"
    }
  ],
  "database_specific": {
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-02-08T16:15:00Z"
  }
}