CVE-2021-28122: Critical severity open5gs vulnerability
A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an unauthenticated user to use a crafted HTTP API request to create, read, update, or delete entries in the subscriber database. For example, new administrative users can be added. The issue occurs because Express is not set up to require authentication.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-28122?
CVE-2021-28122 is a request-validation issue in Open5GS versions 2.1.3 through 2.2.x before 2.2.1.
What is the severity of CVE-2021-28122?
CVE-2021-28122 has a severity rating of 9.8 (Critical).
How does CVE-2021-28122 impact Open5GS?
CVE-2021-28122 allows an unauthenticated user to manipulate the subscriber database through crafted HTTP API requests, potentially leading to the creation, modification, or deletion of entries, including the addition of new administrative users.
Which versions of Open5GS are affected by CVE-2021-28122?
Open5GS versions 2.1.3 through 2.2.x before 2.2.1 are affected by CVE-2021-28122.
How can CVE-2021-28122 be fixed?
To fix CVE-2021-28122, it is recommended to update Open5GS to version 2.2.1 or later.