9.8

CVE-2021-28122

Exploit
A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an unauthenticated user to use a crafted HTTP API request to create, read, update, or delete entries in the subscriber database. For example, new administrative users can be added. The issue occurs because Express is not set up to require authentication.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Open5gs ≫ Open5gs Version >= 2.1.3 <= 2.2.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.96% 0.891
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://github.com/open5gs/open5gs/compare/v2.2.0...v2.2.1
Patch
Third Party Advisory
https://github.com/open5gs/open5gs/issues/837
Third Party Advisory
Exploit
https://github.com/open5gs/open5gs/pull/838
Patch
Third Party Advisory
https://github.com/open5gs/open5gs/releases
Third Party Advisory
Release Notes