CVE-2022-21176 - Airspan Networks Mimosa SQL Injection

Back Back to CVE browser

HIGH

Airspan Networks Mimosa SQL Injection

Published Feb 18, 2022

8.6

HIGH

CVSS 3.1

EPSS 1.05%

Description

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not properly sanitize user input, which may allow an attacker to perform a SQL injection and obtain sensitive information.

Affected products

Vendor Airspan Networks Product MMP Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <v1.0.3
Vendor Airspan Networks Product PTMP C-series and A5x Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <v2.5.4.1
Vendor Airspan Networks Product PTP C-series Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <v2.8.6.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Airspan Networks

MMP

n/a

Version	Status	Constraints
unspecified	affected	<v1.0.3

Airspan Networks

PTMP C-series and A5x

n/a

Version	Status	Constraints
unspecified	affected	<v2.5.4.1

Airspan Networks

PTP C-series

n/a

Version	Status	Constraints
unspecified	affected	<v2.8.6.1

Remediation

Vendor solution

Airspan Networks recommends users update to following products (Login Required):

MMP: Version 1.0.4 or later PTP: C5x: Version 2.90 or later C5c: Version 2.90 or later PTMP: C-series: Version 2.9.0 or later A5x: Version 2.9.0 or later

Weaknesses (1)

CWE-89

SQL Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-26417
Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-034-02
x_refsource_MISCThird Party AdvisoryUS Government Resource

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-26417		Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-034-02		x_refsource_MISCThird Party AdvisoryUS Government Resource