Relative Path Traversal Vulnerability in Ericsson Mobile Switching Center Server
CVE-2021-28485

4.3MEDIUM

Key Information:

Vendor

Ericsson

Status
Mobile Switching Center Server Bc 18a Firmware
Vendor
CVE Published:
14 September 2023

What is CVE-2021-28485?

A vulnerability in the Ericsson Mobile Switching Center Server (MSC-S) prior to IS 3.1 CP22 allows for relative path traversal through a specific parameter in HTTPS requests post-authentication. This flaw enables attackers to access sensitive files on the server that should remain protected from unauthorized web access, potentially leading to severe security breaches and data exposure.

References

https://www.gruppotim.it/it/footer/red-team.html
https://www.ericsson.com/en/about-us/security/psirt

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.