CVE-2021-28122

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an unauthenticated user to use a crafted HTTP API request to create, read, update, or delete entries in the subscriber database. For example, new administrative users can be added. The issue occurs because Express is not set up to require authentication.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/open5gs/open5gs/compare/v2.2.0...v2.2.1Patch, Third Party Advisory
https://github.com/open5gs/open5gs/issues/837Exploit, Third Party Advisory
https://github.com/open5gs/open5gs/pull/838Patch, Third Party Advisory
https://github.com/open5gs/open5gs/releasesRelease Notes, Third Party Advisory
https://github.com/open5gs/open5gs/compare/v2.2.0...v2.2.1Patch, Third Party Advisory
https://github.com/open5gs/open5gs/issues/837Exploit, Third Party Advisory
https://github.com/open5gs/open5gs/pull/838Patch, Third Party Advisory
https://github.com/open5gs/open5gs/releasesRelease Notes, Third Party Advisory

Timeline

Published: Mar 10, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-281239.8Undocumented Default Cryptographic Key Vulnerability in Cohesity DataPlatform version 6.3 prior 6.3.1g, 6.4 up to 6.4.1c and 6.5.1 through 6 CVE-2021-281245.9A man-in-the-middle vulnerability in Cohesity DataPlatform support channel in version 6.3 up to 6.3.1g, 6.4 up to 6.4.1c and 6.5.1 through 6 CVE-2021-281256.1Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input fo CVE-2021-281266.1index.jsp in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a Stored cross-site scripting (XSS) vulnerability CVE-2021-281277.5An issue was discovered in Stormshield SNS through 4.2.1. A brute-force attack can occur.CVE-2021-281288.1In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who ga CVE-2021-281297.8While working on Apache OpenOffice 4.1.8 a developer discovered that the DEB package did not install using root, but instead used a userid a CVE-2021-281307.8Dr.Web Firewall 12.5.2.4160 on Windows incorrectly restricts applications signed by Dr.Web. A DLL for a custom payload within a legitimate b CVE-2021-281317.5Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the CVE-2021-281329.8LUCY Security Awareness Software through 4.7.x allows unauthenticated remote code execution because the Migration Tool (in the Support secti CVE-2021-281334.3Zoom through 5.5.4 sometimes allows attackers to read private information on a participant's screen, even though the participant never attem CVE-2021-281349.8Clipper before 1.0.5 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer