CVE-2021-28488 Missing authorization in n/a
Users in the same authorization group can retrieve managed-network data restricted to a subset of that group, leading to unauthorized data access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-28488?
CVE-2021-28488 is a medium-severity missing authorization vulnerability in n/a, published on 8 Mar 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Ericsson Network Manager (ENM) before 21.2 has incorrect access-control behavior (that only affects the level of access available to persons who were already granted a highly privileged role). Users in the same AMOS authorization group can retrieve managed-network data that was not set to be accessible to the entire group (i.e., was only set to be accessible to a subset of that group).
Weakness: CWE-668
Which versions are affected by CVE-2021-28488?
It affects 1 product.
Products include Ericsson Network Manager.
How do I fix CVE-2021-28488?
No fix has been published for CVE-2021-28488 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-28488 being exploited?
There is no known exploitation of CVE-2021-28488 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2023-39909 Missing authorization in n/a
- CVE-2024-25007 Ericsson Network Manager - Improper Neutralization of Formula Elements Vulnerability
- CVE-2025-27258 Ericsson Network Manager: escalation of privilege vulnerability
- CVE-2022-46408 Code injection in n/a
- CVE-2021-32570 Information disclosure in n/a
Sources
Also known as GHSA-7cm3-m8rx-jcvp.