Vulnerability · Published Aug 16, 2022 · Assigned by facebook
CVE-2022-36312
High 8.8
In plain English
A high-severity cross-site request forgery in AirVelocity from Airspan. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS NVD)8.8High
Exploit odds (30 days)0.3%top 71.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Airspan AirVelocity 1500 software version 15.18.00.2511 lacks CSRF protections in the eNodeB's web management UI. This issue may affect other AirVelocity and AirSpeed models.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Airspan | AirVelocity | unspecified – through 15 |
Weakness: CWE-352
References
- https://helpdesk.airspan.com/browse/TRN3-1695 x_refsource_CONFIRM