CVE-2021-28488

 

Published at: - 10-03-2022 06:42

Last modified: - 24-03-2022 04:26

Total changes: - 5

Description

Ericsson Network Manager (ENM) before 21.2 has incorrect access-control behavior (that only affects the level of access available to persons who were already granted a highly privileged role). Users in the same AMOS authorization group can retrieve managed-network data that was not set to be accessible to the entire group (i.e., was only set to be accessible to a subset of that group).

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

 

Verification logic

 

Reference

• https://www.gruppotim.it/it/footer/red-team.html
• https://www.ericsson.com/en/about-us/enterprise-security/psirt
• https://www.ericsson.com

 

Keywords

NVD

 

CVE-2021-28488

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures