CVE-2021-28122
A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an unauthenticated user to use a crafted HTTP API request to create, read, update, or delete entries in the subscriber database. For example, new administrative users can be added. The issue occurs because Express is not set up to require authentication.
- open5gs
- ≤ 2.2.0
- Fix
- Available
- CVSS 3.1
- 9.8 CRITICAL
- EPSS
- 4.0% (89th percentile)
- Weakness
- CWE-306
- NVD status
- Modified
- Published
- 2021-03-10
CVE-2021-28122 at NVD
No indexed exploits for CVE-2021-28122 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2021-28122 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.