nvd-json-data-feeds/CVE-2021/CVE-2021-325xx/CVE-2021-32570.json

{
  "id": "CVE-2021-32570",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2022-08-26T00:15:08.723",
  "lastModified": "2024-11-21T06:07:17.470",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Ericsson Network Manager (ENM) releases before 21.2, users belonging to the same AMOS authorization group can retrieve the data from certain log files. All AMOS users are considered to be highly privileged users in ENM system and all must be previously defined and authorized by the Security Administrator. Those users can access some log\u2019s files, under a common path, and read information stored in the log\u2019s files in order to conduct privilege escalation."
    },
    {
      "lang": "es",
      "value": "En Ericsson Network Manager (ENM) versiones anteriores a 21.2, los usuarios que pertenecen al mismo grupo de autorizaci\u00f3n de AMOS pueden recuperar los datos de determinados archivos de registro. Todos los usuarios de AMOS son considerados usuarios altamente privilegiados en el sistema ENM y todos deben ser previamente definidos y autorizados por el Administrador de Seguridad. Estos usuarios pueden acceder a algunos archivos de registro, bajo una ruta com\u00fan, y leer la informaci\u00f3n almacenada en los archivos de registro con el fin de conducir una escalada de privilegios."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 4.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 3.6
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ericsson:network_manager:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "21.2",
              "matchCriteriaId": "944DF153-84C6-4258-A87E-DB1143B21DE4"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.ericsson.com",
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.gruppotim.it/it/footer/red-team.html",
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.ericsson.com",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.gruppotim.it/it/footer/red-team.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}