PT-2021-19432 · Sipwise · Sipwise C5 Ngcp Www Csc+1

Gjoko Krstic · Published 2021-04-23 · Updated 2022-07-30 · CVE-2021-31584

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sipwise C5 NGCP www csc version 3.6.4 up to and including platform NGCP CE mr3.8.13 Sipwise C5 NGCP www admin version 3.6.7

Description The issue allows call/click2dial CSRF attacks for actions with administrative privileges. This can potentially lead to unauthorized actions being performed with administrative privileges.

Recommendations For Sipwise C5 NGCP www csc version 3.6.4 up to and including platform NGCP CE mr3.8.13, consider implementing CSRF protection measures to prevent unauthorized actions. For Sipwise C5 NGCP www admin version 3.6.7, restrict access to administrative actions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-31584

Affected Products

Sipwise C5 Ngcp Www Admin

Sipwise C5 Ngcp Www Csc

References · 8

• 🔥 http://packetstormsecurity.com/files/162318/Sipwise-C5-NGCP-CSC-Cross-Site-Request-Forgery.html · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-31584 · Security Note
• http://lists.sipwise.com/pipermail/spce-user_lists.sipwise.com/2021-September/014708.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-31584 · Vendor Advisory
• https://t.me/cvenotify/14292 · Telegram Post
• https://zeroscience.mk/en/vulnerabilities/ZSL-2021-5649.php · Note
• https://sipwise.com · Note