CVE-2023-4884 Multiple vulnerabilities in Open5GS
An attacker can retrieve sensitive device information from Open5GS endpoints due to missing authentication controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4884?
CVE-2023-4884 is a medium-severity missing authorization vulnerability in Open5gs Open5gs, published on 3 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker could send an HTTP request to an Open5GS endpoint and retrieve the information stored on the device due to the lack of Authentication.
Weakness: CWE-306
Which versions are affected by CVE-2023-4884?
It affects 1 product.
Products include Open5gs Open5gs.
How do I fix CVE-2023-4884?
No fix has been published for CVE-2023-4884 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-4884 being exploited?
There is no known exploitation of CVE-2023-4884 in the wild and no public exploit code.
Other vulnerabilities in Open5gs Open5gs
Sources
Also known as GHSA-rpmg-pqrf-89p5.