This vulnerability could allow an attacker to force the server to create and execute a web request granting access to backend APIs that are only accessible to the Mimosa MMP server, or request pages that could perform some actions themselves. The attacker could force the server into accessing routes on those cloud-hosting platforms, accessing secret keys, changing configurations, etc. Affecting MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1.
References
Link | Resource |
---|---|
https://www.cisa.gov/uscert/ics/advisories/icsa-22-034-02 | Third Party Advisory US Government Resource |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
AND |
|
Configuration 3 (hide)
AND |
|
Configuration 4 (hide)
AND |
|
Configuration 5 (hide)
AND |
|
History
26 Feb 2022, 04:53
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-918 | |
CPE | cpe:2.3:o:airspan:c5x_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:airspan:a5x:-:*:*:*:*:*:*:* cpe:2.3:h:airspan:c5x:-:*:*:*:*:*:*:* cpe:2.3:o:airspan:a5x_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:airspan:c5c:-:*:*:*:*:*:*:* cpe:2.3:a:airspan:mimosa_management_platform:*:*:*:*:*:*:*:* cpe:2.3:o:airspan:c5c_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:airspan:c6x:-:*:*:*:*:*:*:* cpe:2.3:o:airspan:c6x_firmware:*:*:*:*:*:*:*:* |
|
CVSS |
v2 : v3 : |
v2 : 10.0
v3 : 9.8 |
First Time |
Airspan c5x Firmware
Airspan c6x Firmware Airspan c6x Airspan mimosa Management Platform Airspan Airspan a5x Firmware Airspan c5x Airspan c5c Firmware Airspan c5c Airspan a5x |
|
References | (MISC) https://www.cisa.gov/uscert/ics/advisories/icsa-22-034-02 - Third Party Advisory, US Government Resource |
18 Feb 2022, 18:33
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-02-18 18:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-21215
Mitre link : CVE-2022-21215
CVE.ORG link : CVE-2022-21215
JSON object : View
Products Affected
airspan
- c6x_firmware
- c6x
- mimosa_management_platform
- c5x_firmware
- c5c_firmware
- a5x_firmware
- c5x
- c5c
- a5x
CWE
CWE-918
Server-Side Request Forgery (SSRF)