CVE-2022-21215 Airspan Networks Mimosa Server-Side Request Forgery (SSRF)

Critical 10.0 Published 18 Feb 2022 Updated 16 Apr 2025

An attacker can force the server to make unauthorized requests, potentially accessing backend APIs, secret keys, or changing configurations.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-21215?

CVE-2022-21215 is a critical server-side request forgery vulnerability in Airspan Networks MMP, published on 18 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

This vulnerability could allow an attacker to force the server to create and execute a web request granting access to backend APIs that are only accessible to the Mimosa MMP server, or request pages that could perform some actions themselves. The attacker could force the server into accessing routes on those cloud-hosting platforms, accessing secret keys, changing configurations, etc. Affecting MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1.

Weakness: CWE-918

Which versions are affected by CVE-2022-21215?

It affects 5 products.

Products include Airspan A5x Firmware, Airspan C5c Firmware, Airspan C5x Firmware, Airspan C6x Firmware, Airspan Mimosa Management Platform.

How do I fix CVE-2022-21215?

No fix has been published for CVE-2022-21215 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2022-21215 being exploited?

There is no known exploitation of CVE-2022-21215 in the wild and no public exploit code.

Sources

Also known as GHSA-hqrh-5ffw-2jfp.