CVE-2021-28122

    Dashboard / Vulnerabilities / CVE-2021-28122

    CVE-2021-28122

    Published: 10 Mar 2021Last Modified: 7 Aug 2026

    Summary:

    Details: A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an unauthenticated user to use a crafted HTTP API request to create, read, update, or delete entries in the subscriber database. For example, new administrative users can be added. The issue occurs because Express is not set up to require authentication.

    References: https://github.com/open5gs/open5gs/releases, https://github.com/open5gs/open5gs/compare/v2.2.0...v2.2.1, https://github.com/open5gs/open5gs/pull/838, https://github.com/open5gs/open5gs/issues/837

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- d6ed13968dfa28e68dce6a3828ae30cc2bb20ede
    Fixed -None

    Affected versions

    v2.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-28122 | CVE-DB