CVEvulnerability
CVE-2021-28122
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2021-03-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-306
Description
A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an unauthenticated user to use a crafted HTTP API request to create, read, update, or delete entries in the subscriber database. For example, new administrative users can be added. The issue occurs because Express is not set up to require authentication.
Affected configurations
• open5gs open5gs (>= 2.1.3 <= 2.2.0)
Related
Weakness · CWE (1)
- CWE-306 Missing Authentication for Critical Functionality weakness
References
- https://github.com/open5gs/open5gs/compare/v2.2.0...v2.2.1 Patch, Third Party Advisory
- https://github.com/open5gs/open5gs/issues/837 Exploit, Third Party Advisory
- https://github.com/open5gs/open5gs/pull/838 Patch, Third Party Advisory
- https://github.com/open5gs/open5gs/releases Release Notes, Third Party Advisory
- https://github.com/open5gs/open5gs/compare/v2.2.0...v2.2.1 Patch, Third Party Advisory
- https://github.com/open5gs/open5gs/issues/837 Exploit, Third Party Advisory
- https://github.com/open5gs/open5gs/pull/838 Patch, Third Party Advisory
- https://github.com/open5gs/open5gs/releases Release Notes, Third Party Advisory