In Ericsson Mobile Switching Center Server (MSC-S) before IS 3.1 CP22, the SIS web application allows relative path traversal via a specific parameter in the https request after authentication, which allows access to files on the system that are not intended to be accessible via the web application.
References
| Link | Resource |
|---|---|
| https://www.ericsson.com/en/about-us/security/psirt | Vendor Advisory |
| https://www.gruppotim.it/it/footer/red-team.html | Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
25 Oct 2023, 20:13
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
21 Sep 2023, 12:51
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-22 | |
| First Time |
Ericsson mobile Switching Center Server Bc 18a Firmware
Ericsson mobile Switching Center Server Bc 18a Ericsson |
|
| References | (MISC) https://www.ericsson.com/en/about-us/security/psirt - Vendor Advisory | |
| References | (MISC) https://www.gruppotim.it/it/footer/red-team.html - Third Party Advisory | |
| CPE | cpe:2.3:h:ericsson:mobile_switching_center_server_bc_18a:-:*:*:*:*:*:*:* cpe:2.3:o:ericsson:mobile_switching_center_server_bc_18a_firmware:*:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
19 Sep 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
15 Sep 2023, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-14 15:15
Updated : 2024-02-28 20:33
NVD link : CVE-2021-28485
Mitre link : CVE-2021-28485
CVE.ORG link : CVE-2021-28485
JSON object : View
Products Affected
ericsson
- mobile_switching_center_server_bc_18a_firmware
- mobile_switching_center_server_bc_18a
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')