by Kastro
Paper/Archive/CVE-2022-21215

CVE-2022-21215

Airspan Networks MMP — Airspan Networks Mimosa Server-Side Request Forgery (SSRF)

EPSS 1%CVSS 10.0
critical.is priorityof 100
45
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 72.7.727 × 2014.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

This vulnerability could allow an attacker to force the server to create and execute a web request granting access to backend APIs that are only accessible to the Mimosa MMP server, or request pages that could perform some actions themselves. The attacker could force the server into accessing routes on those cloud-hosting platforms, accessing secret keys, changing configurations, etc. Affecting MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1.

Affected

ProductAffectedFixed inSource
MMPunspecified – < v1.0.3v1.0.3CNA
PTP C-seriesunspecified – < v2.8.6.1v2.8.6.1CNA
PTMP C-series and A5xunspecified – < v2.5.4.1v2.5.4.1CNA

Scores by source

icscert (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-22-034-02