Posted by disclosure via Fulldisclosure on Aug 06 0day Rubbish Research Team is publicly disclosing a vulnerability in Plastic SCM (Unity Version Control On-Prem)

11.0.16.10303 (Unity Technologies). The research is published and a proof-of-concept is available.

Pre-authentication RCE (CVSS 9.8, pre-authentication)

Plastic SCM ships a self-developed binary version-control protocol on port 8087, reachable by default on 0.0.0.0. Under

the default NameWorkingMode, the server validates only that...