CVE-2021-28122

2021-03-1014:34:45

mitre

www.cve.org

open5gs

request-validation

unauthenticated

http api

database manipulation

express

AI Score

9.5

Confidence

High

EPSS

0.002

Percentile

62.1%

JSON

A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an unauthenticated user to use a crafted HTTP API request to create, read, update, or delete entries in the subscriber database. For example, new administrative users can be added. The issue occurs because Express is not set up to require authentication.