CVE-2021-28485: Path Traversal
In Ericsson Mobile Switching Center Server (MSC-S) before IS 3.1 CP22, the SIS web application allows relative path traversal via a specific parameter in the https request after authentication, which allows access to files on the system that are not intended to be accessible via the web application.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-28485?
CVE-2021-28485 is a vulnerability in Ericsson Mobile Switching Center Server (MSC-S) before IS 3.1 CP22 that allows relative path traversal, leading to unauthorized access to system files.
What is the severity of CVE-2021-28485?
The severity of CVE-2021-28485 is medium with a CVSS score of 6.5.
How does CVE-2021-28485 affect Ericsson Mobile Switching Center Server (MSC-S)?
CVE-2021-28485 affects Ericsson Mobile Switching Center Server (MSC-S) before IS 3.1 CP22, allowing unauthorized access to files on the system via the SIS web application.
How can I fix CVE-2021-28485?
To fix CVE-2021-28485, it is recommended to update Ericsson Mobile Switching Center Server (MSC-S) to IS 3.1 CP22 or later.
Where can I find more information about CVE-2021-28485?
More information about CVE-2021-28485 can be found on the Ericsson PSIRT website and the Gruppo Tim website.