CVE-2021-28122: open5gs

Vulnerability summary

CVE-2021-28122 is a critical (CVSS 9.8) vulnerability in open5gs. EPSS estimates a 3.96% chance of exploitation in the next 30 days, higher than 90.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 10-03-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an unauthenticated user to use a crafted HTTP API request to create, read, update, or delete entries in the subscriber database. For example, new administrative users can be added. The issue occurs because Express is not set up to require authentication.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.