CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-25007 – Ericsson Network Manager - Improper Neutralization of Formula Elements Vulnerability
https://notcve.org/view.php?id=CVE-2024-25007
Ericsson Network Manager (ENM), versions prior to 23.1, contains a vulnerability in the export function of application log where Improper Neutralization of Formula Elements in a CSV File can lead to code execution or information disclosure. There is limited impact to integrity and availability. The attacker on the adjacent network with administration access can exploit the vulnerability. Ericsson Network Manager (ENM), versiones anteriores a la 23.1, contiene una vulnerabilidad en la función de exportación del registro de la aplicación donde la neutralización inadecuada de elementos de fórmula en un archivo CSV puede provocar la ejecución de código o la divulgación de información. El impacto en la integridad y la disponibilidad es limitado. • https://www.ericsson.com/en/about-us/security/psirt/security-bulletin--ericsson-network-manager-march-2024 • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-39909
https://notcve.org/view.php?id=CVE-2023-39909
Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users can access the NCM application. Ericsson Network Manager anterior a 23.2 maneja mal el control de acceso y, por lo tanto, los usuarios no autenticados con pocos privilegios pueden acceder a la aplicación NCM. • https://www.gruppotim.it/it/footer/red-team.html •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-46408
https://notcve.org/view.php?id=CVE-2022-46408
Ericsson Network Manager (ENM), versions prior to 22.1, contains a vulnerability in the application Network Connectivity Manager (NCM) where improper Neutralization of Formula Elements in a CSV File can lead to remote code execution or data leakage via maliciously injected hyperlinks. The attacker would need admin/elevated access to exploit the vulnerability. • https://www.gruppotim.it/it/footer/red-team.html • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-46407
https://notcve.org/view.php?id=CVE-2022-46407
Ericsson Network Manager (ENM), versions prior to 22.2, contains a vulnerability in the REST endpoint “editprofile” where Open Redirect HTTP Header Injection can lead to redirection of the submitted request to domain out of control of ENM deployment. The attacker would need admin/elevated access to exploit the vulnerability • https://www.gruppotim.it/it/footer/red-team.html • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2021-32570
https://notcve.org/view.php?id=CVE-2021-32570
In Ericsson Network Manager (ENM) releases before 21.2, users belonging to the same AMOS authorization group can retrieve the data from certain log files. All AMOS users are considered to be highly privileged users in ENM system and all must be previously defined and authorized by the Security Administrator. Those users can access some log’s files, under a common path, and read information stored in the log’s files in order to conduct privilege escalation. En Ericsson Network Manager (ENM) versiones anteriores a 21.2, los usuarios que pertenecen al mismo grupo de autorización de AMOS pueden recuperar los datos de determinados archivos de registro. Todos los usuarios de AMOS son considerados usuarios altamente privilegiados en el sistema ENM y todos deben ser previamente definidos y autorizados por el Administrador de Seguridad. • https://www.ericsson.com https://www.gruppotim.it/it/footer/red-team.html • CWE-532: Insertion of Sensitive Information into Log File •