CVE-2021-28122

Katalog CVE

CVSS 9.8 · Critical EPSS 4,0%

Kerentanan Missing Authentication for Critical Function pada open5gs. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an unauthenticated user to use a crafted HTTP API request to create, read, update, or delete entries in the subscriber database. For example, new administrative users can be added. The issue occurs because Express is not set up to require authentication.

Rincian

Terbit di NVD

10 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

4,0% peluang dieksploitasi; lebih tinggi dari 90,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/open5gs/open5gs/compare/v2.2.0...v2.2.1 patch · advisory pihak ketiga
• https://github.com/open5gs/open5gs/pull/838 patch · advisory pihak ketiga
• https://github.com/open5gs/open5gs/issues/837 exploit · advisory pihak ketiga
• https://github.com/open5gs/open5gs/releases release notes · advisory pihak ketiga