CVE-2019-5456

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

SMTP MITM refers to a malicious actor setting up an SMTP proxy server between the UniFi Controller version <= 5.10.21 and their actual SMTP server to record their SMTP credentials for malicious use later.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-300 CWE-255

Affected software

Vendor	Product	Versions
UniFi	UniFi	<= 5.10.21

References

https://community.ui.com/releases/862b962b-55f6-4324-96be-610f647d5c1cRelease Notes, Vendor Advisory
https://community.ui.com/releases/9f698d0b-8279-40d3-9f1a-d36db4813124Release Notes, Vendor Advisory
https://community.ui.com/releases/Security-Advisory-Bulletin-003-003/982bbaa8-2a07-4f81-a5f6-0bb84753f391Vendor Advisory
https://hackerone.com/reports/519582Permissions Required
https://community.ui.com/releases/862b962b-55f6-4324-96be-610f647d5c1cRelease Notes, Vendor Advisory
https://community.ui.com/releases/9f698d0b-8279-40d3-9f1a-d36db4813124Release Notes, Vendor Advisory
https://community.ui.com/releases/Security-Advisory-Bulletin-003-003/982bbaa8-2a07-4f81-a5f6-0bb84753f391Vendor Advisory
https://hackerone.com/reports/519582Permissions Required

Timeline

Published: Jul 30, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-54575.4Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server file system to execu CVE-2019-54585.4Cross-site scripting (XSS) vulnerability in http-file-server (all versions) allows an attacker with access to the server file system to exec CVE-2019-54597.1An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read.CVE-2019-54605.5Double Free in VLC versions <= 3.0.6 leads to a crash.CVE-2019-54613.5An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary CVE-2019-54628.8A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has cha CVE-2019-54635.3An authorization issue was discovered in the GitLab CE/EE CI badge images endpoint which could result in disclosure of the build status. Thi CVE-2019-54649.8A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF whe CVE-2019-54654.3An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclos CVE-2019-54664.3An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.CVE-2019-54675.4An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature which could result in a persistent XSS. CVE-2019-54688.8An privilege escalation issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 when Mattermost slash commands are used wi