PT-2022-9892 · Ericsson · Ericsson Network Manager

Alessandro Bosco + 2 · Published 2022-03-08 · Updated 2022-07-12 · CVE-2021-28488

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ericsson Network Manager versions prior to 21.2

Description The issue concerns incorrect access-control behavior, affecting users with highly privileged roles. It allows users within the same AMOS authorization group to retrieve managed-network data not intended for their access, specifically data restricted to a subset of the group.

Recommendations For Ericsson Network Manager versions prior to 21.2, update to version 21.2 or later to resolve the issue.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2021-28488

Affected Products

Ericsson Network Manager

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-28488 · Security Note
• https://osv.dev/vulnerability/CVE-2021-28488 · Vendor Advisory
• https://ericsson.com/en/about-us/enterprise-security/psirt · Vendor Advisory
• https://ericsson.com · Vendor Advisory
• https://t.me/cibsecurity/38706 · Telegram Post
• https://t.me/cvenotify/28042 · Telegram Post
• https://gruppotim.it/it/footer/red-team.html · Note