CVE Feed

    Dashboard / CVE / CVE-2021-28488

    CVE-2021-28488

    Ericsson Network Manager (ENM) before 21.2 has incorrect access-control behavior (that only affects the level of access available to persons who were already granted a highly privileged role). Users in the same AMOS authorization group can retrieve managed-network data that was not set to be accessible to the entire group (i.e., was only set to be accessible to a subset of that group).

    Published:Mar 8, 2022
    Last Modified:Nov 21, 2024
    EPS:Mar 8, 2022
    EPSS Score:0.0063
    CVSS Score:6.5

    Affected Products

    Vendor
    Ericsson
    Product
    Network Manager

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2025-27258 (CVSS 6.9) — Ericsson Network Manager (ENM) versions prior to ENM 25.1 GA contain a vulnerability, if exploited, can result…
    CVE-2025-27259 (CVSS 2.4) — Ericsson Network Manager versions prior to ENM 25.2 GA contain a vulnerability that, if exploited, can exfiltr…
    CVE-2024-25007 (CVSS 7.1) — Ericsson Network Manager (ENM), versions prior to 23.1, contains a vulnerability in the export function of ap…
    CVE-2023-39909 (CVSS 8.8) — Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users ca…
    CVE-2022-46408 (CVSS 6.8) — Ericsson Network Manager (ENM), versions prior to 22.1, contains a vulnerability in the application Network Co…
    CVE-2022-46407 (CVSS 4.8) — Ericsson Network Manager (ENM), versions prior to 22.2, contains a vulnerability in the REST endpoint “editpro…
    CVE-2021-32570 (CVSS 4.9) — In Ericsson Network Manager (ENM) releases before 21.2, users belonging to the same AMOS authorization group c…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High