All the vulnerabilites related to arubanetworks - 7240xm
cve-2023-22765
Vulnerability from cvelistv5
Published
2023-02-28 16:47
Modified
2024-08-02 10:20
Severity ?
EPSS score ?
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Hewlett Packard Enterprise (HPE) | Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central |
Version: ArubaOS 8.6.x.x: 8.6.0.19 and below Version: ArubaOS 8.10.x.x: 8.10.0.4 and below Version: ArubaOS 10.3.x.x: 10.3.1.0 and below Version: SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:20:30.366Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"status": "affected",
"version": "ArubaOS 8.6.x.x: 8.6.0.19 and below"
},
{
"status": "affected",
"version": "ArubaOS 8.10.x.x: 8.10.0.4 and below"
},
{
"status": "affected",
"version": "ArubaOS 10.3.x.x: 10.3.1.0 and below"
},
{
"status": "affected",
"version": "SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Erik de Jong (bugcrowd.com/erikdejong)"
}
],
"datePublic": "2023-02-28T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-01T05:45:13.020935Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated Remote Command Execution in the ArubaOS Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2023-22765",
"datePublished": "2023-02-28T16:47:35.008Z",
"dateReserved": "2023-01-06T15:24:20.505Z",
"dateUpdated": "2024-08-02T10:20:30.366Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-24637
Vulnerability from cvelistv5
Published
2020-12-11 01:33
Modified
2024-08-04 15:19
Severity ?
EPSS score ?
Summary
Two vulnerabilities in ArubaOS GRUB2 implementation allows for an attacker to bypass secureboot. Successful exploitation of this vulnerability this could lead to remote compromise of system integrity by allowing an attacker to load an untrusted or modified kernel in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below ; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below.
References
| ▼ | URL | Tags |
|---|---|---|
| https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04072en_us | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | n/a | Aruba 9000 Gateway |
Version: 2.1.0.1 Version: 2.2.0.0 and below |
||||||||
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:19:09.053Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbnw04072en_us"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Aruba 9000 Gateway",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "2.1.0.1"
},
{
"status": "affected",
"version": "2.2.0.0 and below"
}
]
},
{
"product": "Aruba 7000 Series Mobility Controllers",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "6.4.4.23"
},
{
"status": "affected",
"version": "6.5.4.17"
},
{
"status": "affected",
"version": "8.2.2.9"
},
{
"status": "affected",
"version": "8.3.0.13"
},
{
"status": "affected",
"version": "8.5.0.10"
},
{
"status": "affected",
"version": "8.6.0.5"
},
{
"status": "affected",
"version": "8.7.0.0 and below"
}
]
},
{
"product": "Aruba 7200 Series Mobility Controllers",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "6.4.4.23"
},
{
"status": "affected",
"version": "6.5.4.17"
},
{
"status": "affected",
"version": "8.2.2.9"
},
{
"status": "affected",
"version": "8.3.0.13"
},
{
"status": "affected",
"version": "8.5.0.10"
},
{
"status": "affected",
"version": "8.6.0.5"
},
{
"status": "affected",
"version": "8.7.0.0 and below"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Two vulnerabilities in ArubaOS GRUB2 implementation allows for an attacker to bypass secureboot. Successful exploitation of this vulnerability this could lead to remote compromise of system integrity by allowing an attacker to load an untrusted or modified kernel in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below ; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "remote buffer overflow",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-11T01:33:22",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbnw04072en_us"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-alert@hpe.com",
"ID": "CVE-2020-24637",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Aruba 9000 Gateway",
"version": {
"version_data": [
{
"version_value": "2.1.0.1"
},
{
"version_value": "2.2.0.0 and below"
}
]
}
},
{
"product_name": "Aruba 7000 Series Mobility Controllers",
"version": {
"version_data": [
{
"version_value": "6.4.4.23"
},
{
"version_value": "6.5.4.17"
},
{
"version_value": "8.2.2.9"
},
{
"version_value": "8.3.0.13"
},
{
"version_value": "8.5.0.10"
},
{
"version_value": "8.6.0.5"
},
{
"version_value": "8.7.0.0 and below"
}
]
}
},
{
"product_name": "Aruba 7200 Series Mobility Controllers",
"version": {
"version_data": [
{
"version_value": "6.4.4.23"
},
{
"version_value": "6.5.4.17"
},
{
"version_value": "8.2.2.9"
},
{
"version_value": "8.3.0.13"
},
{
"version_value": "8.5.0.10"
},
{
"version_value": "8.6.0.5"
},
{
"version_value": "8.7.0.0 and below"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Two vulnerabilities in ArubaOS GRUB2 implementation allows for an attacker to bypass secureboot. Successful exploitation of this vulnerability this could lead to remote compromise of system integrity by allowing an attacker to load an untrusted or modified kernel in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below ; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "remote buffer overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbnw04072en_us",
"refsource": "CONFIRM",
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbnw04072en_us"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2020-24637",
"datePublished": "2020-12-11T01:33:22",
"dateReserved": "2020-08-25T00:00:00",
"dateUpdated": "2024-08-04T15:19:09.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-22766
Vulnerability from cvelistv5
Published
2023-02-28 16:48
Modified
2024-08-02 10:20
Severity ?
EPSS score ?
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Hewlett Packard Enterprise (HPE) | Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central |
Version: ArubaOS 8.6.x.x: 8.6.0.19 and below Version: ArubaOS 8.10.x.x: 8.10.0.4 and below Version: ArubaOS 10.3.x.x: 10.3.1.0 and below Version: SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:20:30.419Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"status": "affected",
"version": "ArubaOS 8.6.x.x: 8.6.0.19 and below"
},
{
"status": "affected",
"version": "ArubaOS 8.10.x.x: 8.10.0.4 and below"
},
{
"status": "affected",
"version": "ArubaOS 10.3.x.x: 10.3.1.0 and below"
},
{
"status": "affected",
"version": "SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Erik de Jong (bugcrowd.com/erikdejong)"
}
],
"datePublic": "2023-02-28T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-01T05:45:13.020935Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated Remote Command Execution in the ArubaOS Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2023-22766",
"datePublished": "2023-02-28T16:48:00.530Z",
"dateReserved": "2023-01-06T15:24:20.505Z",
"dateUpdated": "2024-08-02T10:20:30.419Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-37900
Vulnerability from cvelistv5
Published
2022-11-03 18:56
Modified
2024-08-03 10:37
Severity ?
EPSS score ?
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T10:37:42.504Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise",
"versions": [
{
"status": "unaffected",
"version": "ArubaOS 6.5.4.x: 6.5.4.23 and above; ArubaOS 8.6.x: 8.6.0.18 and above; ArubaOS 8.7.x: 8.7.1.10 and above; ArubaOS 8.10.x: 8.10.0.0 and above; ArubaOS 10.3.x: 10.3.0.1 and above; SD-WAN-2.3.0.x: 8.7.0.0-2.3.0.7 and above"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. \u003c/p\u003e"
}
],
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. \n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-12T12:11:04.548862Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "cveClient/1.0.13"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2022-37900",
"datePublished": "2022-11-03T18:56:36.481Z",
"dateReserved": "2022-08-08T18:45:22.549Z",
"dateUpdated": "2024-08-03T10:37:42.504Z",
"requesterUserId": "6707ad87-4508-4473-b324-feac48da5e14",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-37898
Vulnerability from cvelistv5
Published
2022-11-03 18:23
Modified
2024-08-03 10:37
Severity ?
EPSS score ?
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T10:37:42.118Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise",
"versions": [
{
"status": "unaffected",
"version": "ArubaOS 6.5.4.x: 6.5.4.23 and above; ArubaOS 8.6.x: 8.6.0.18 and above; ArubaOS 8.7.x: 8.7.1.10 and above; ArubaOS 8.10.x: 8.10.0.0 and above; ArubaOS 10.3.x: 10.3.0.1 and above; SD-WAN-2.3.0.x: 8.7.0.0-2.3.0.7 and above"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. \u003c/p\u003e"
}
],
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. \n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-12T12:11:04.548862Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "cveClient/1.0.13"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2022-37898",
"datePublished": "2022-11-03T18:23:31.634Z",
"dateReserved": "2022-08-08T18:45:22.549Z",
"dateUpdated": "2024-08-03T10:37:42.118Z",
"requesterUserId": "6707ad87-4508-4473-b324-feac48da5e14",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-22776
Vulnerability from cvelistv5
Published
2023-02-28 17:02
Modified
2024-08-02 10:20
Severity ?
EPSS score ?
Summary
An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files on the underlying operating system, including sensitive system files.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Hewlett Packard Enterprise (HPE) | Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central |
Version: ArubaOS 8.6.x.x: 8.6.0.19 and below Version: ArubaOS 8.10.x.x: 8.10.0.4 and below Version: ArubaOS 10.3.x.x: 10.3.1.0 and below Version: SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:20:30.370Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"status": "affected",
"version": "ArubaOS 8.6.x.x: 8.6.0.19 and below"
},
{
"status": "affected",
"version": "ArubaOS 8.10.x.x: 8.10.0.4 and below"
},
{
"status": "affected",
"version": "ArubaOS 10.3.x.x: 10.3.1.0 and below"
},
{
"status": "affected",
"version": "SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Nicholas Starke of Aruba Threat Labs"
}
],
"datePublic": "2023-02-28T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files on the underlying operating system, including sensitive system files.\u003cbr\u003e"
}
],
"value": "An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files on the underlying operating system, including sensitive system files.\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-01T05:45:13.020935Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated Remote Path Traversal in ArubaOS Command Line Interface Allows for Arbitrary File Read",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2023-22776",
"datePublished": "2023-02-28T17:02:51.772Z",
"dateReserved": "2023-01-06T15:24:20.509Z",
"dateUpdated": "2024-08-02T10:20:30.370Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-37908
Vulnerability from cvelistv5
Published
2022-11-03 19:29
Modified
2024-08-03 10:37
Severity ?
EPSS score ?
Summary
An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exploitation can compromise the hardware chain of trust on the impacted controller.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T10:37:42.105Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise",
"versions": [
{
"status": "unaffected",
"version": "ArubaOS 6.5.4.x: 6.5.4.23 and above; ArubaOS 8.6.x: 8.6.0.18 and above; ArubaOS 8.7.x: 8.7.1.10 and above; ArubaOS 8.10.x: 8.10.0.0 and above; ArubaOS 10.3.x: 10.3.0.1 and above; SD-WAN-2.3.0.x: 8.7.0.0-2.3.0.7 and above"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exploitation can compromise the hardware chain of trust on the impacted controller.\u003c/p\u003e"
}
],
"value": "An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exploitation can compromise the hardware chain of trust on the impacted controller.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-12T12:11:04.548862Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "cveClient/1.0.13"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2022-37908",
"datePublished": "2022-11-03T19:29:32.777Z",
"dateReserved": "2022-08-08T18:45:22.552Z",
"dateUpdated": "2024-08-03T10:37:42.105Z",
"requesterUserId": "6707ad87-4508-4473-b324-feac48da5e14",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-37731
Vulnerability from cvelistv5
Published
2021-09-07 12:41
Modified
2024-08-04 01:30
Severity ?
EPSS score ?
Summary
A local path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.0-2.2.0.4; Prior to 8.7.1.1, 8.6.0.7, 8.5.0.12, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt | x_refsource_MISC | |
| https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | n/a | Aruba SD-WAN Software and Gateways; Aruba Operating System Software |
Version: Prior to 8.6.0.0-2.2.0.4 Version: Prior to 8.7.1.1, 8.6.0.7, 8.5.0.12, 8.3.0.16 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:30:07.497Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Aruba SD-WAN Software and Gateways; Aruba Operating System Software",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Prior to 8.6.0.0-2.2.0.4"
},
{
"status": "affected",
"version": "Prior to 8.7.1.1, 8.6.0.7, 8.5.0.12, 8.3.0.16"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A local path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.0-2.2.0.4; Prior to 8.7.1.1, 8.6.0.7, 8.5.0.12, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "local path traversal",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-12T11:06:31",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-alert@hpe.com",
"ID": "CVE-2021-37731",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Aruba SD-WAN Software and Gateways; Aruba Operating System Software",
"version": {
"version_data": [
{
"version_value": "Prior to 8.6.0.0-2.2.0.4"
},
{
"version_value": "Prior to 8.7.1.1, 8.6.0.7, 8.5.0.12, 8.3.0.16"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A local path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.0-2.2.0.4; Prior to 8.7.1.1, 8.6.0.7, 8.5.0.12, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "local path traversal"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt",
"refsource": "MISC",
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt"
},
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2021-37731",
"datePublished": "2021-09-07T12:41:13",
"dateReserved": "2021-07-29T00:00:00",
"dateUpdated": "2024-08-04T01:30:07.497Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-22762
Vulnerability from cvelistv5
Published
2023-02-28 16:46
Modified
2024-08-02 10:20
Severity ?
EPSS score ?
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Hewlett Packard Enterprise (HPE) | Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central |
Version: ArubaOS 8.6.x.x: 8.6.0.19 and below Version: ArubaOS 8.10.x.x: 8.10.0.4 and below Version: ArubaOS 10.3.x.x: 10.3.1.0 and below Version: SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:20:30.196Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"status": "affected",
"version": "ArubaOS 8.6.x.x: 8.6.0.19 and below"
},
{
"status": "affected",
"version": "ArubaOS 8.10.x.x: 8.10.0.4 and below"
},
{
"status": "affected",
"version": "ArubaOS 10.3.x.x: 10.3.1.0 and below"
},
{
"status": "affected",
"version": "SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Erik de Jong (bugcrowd.com/erikdejong)"
}
],
"datePublic": "2023-02-28T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-01T05:45:13.020935Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated Remote Command Execution in the ArubaOS Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2023-22762",
"datePublished": "2023-02-28T16:46:03.890Z",
"dateReserved": "2023-01-06T15:24:20.505Z",
"dateUpdated": "2024-08-02T10:20:30.196Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-22767
Vulnerability from cvelistv5
Published
2023-02-28 16:49
Modified
2024-08-02 10:20
Severity ?
EPSS score ?
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Hewlett Packard Enterprise (HPE) | Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central |
Version: ArubaOS 8.6.x.x: 8.6.0.19 and below Version: ArubaOS 8.10.x.x: 8.10.0.4 and below Version: ArubaOS 10.3.x.x: 10.3.1.0 and below Version: SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:20:30.363Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"status": "affected",
"version": "ArubaOS 8.6.x.x: 8.6.0.19 and below"
},
{
"status": "affected",
"version": "ArubaOS 8.10.x.x: 8.10.0.4 and below"
},
{
"status": "affected",
"version": "ArubaOS 10.3.x.x: 10.3.1.0 and below"
},
{
"status": "affected",
"version": "SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Daniel Jensen (@dozernz)"
}
],
"datePublic": "2023-02-28T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-01T05:45:13.020935Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated Remote Command Execution in the ArubaOS Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2023-22767",
"datePublished": "2023-02-28T16:49:03.354Z",
"dateReserved": "2023-01-06T15:24:20.506Z",
"dateUpdated": "2024-08-02T10:20:30.363Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-22771
Vulnerability from cvelistv5
Published
2023-02-28 16:53
Modified
2024-08-02 10:20
Severity ?
EPSS score ?
Summary
An insufficient session expiration vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability allows an attacker to keep a session running on an affected device after the removal of the impacted account
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Hewlett Packard Enterprise (HPE) | Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central |
Version: ArubaOS 8.6.x.x: 8.6.0.19 and below Version: ArubaOS 8.10.x.x: 8.10.0.4 and below Version: ArubaOS 10.3.x.x: 10.3.1.0 and below Version: SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:20:30.380Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"status": "affected",
"version": "ArubaOS 8.6.x.x: 8.6.0.19 and below"
},
{
"status": "affected",
"version": "ArubaOS 8.10.x.x: 8.10.0.4 and below"
},
{
"status": "affected",
"version": "ArubaOS 10.3.x.x: 10.3.1.0 and below"
},
{
"status": "affected",
"version": "SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Mitchell Pompe of Netskope"
}
],
"datePublic": "2023-02-28T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An insufficient session expiration vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability allows an attacker to keep a session running on an affected device after the removal of the impacted account\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "An insufficient session expiration vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability allows an attacker to keep a session running on an affected device after the removal of the impacted account\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-01T05:45:13.020935Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Insufficient Session Expiration in ArubaOS Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2023-22771",
"datePublished": "2023-02-28T16:53:19.915Z",
"dateReserved": "2023-01-06T15:24:20.507Z",
"dateUpdated": "2024-08-02T10:20:30.380Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-37901
Vulnerability from cvelistv5
Published
2022-11-03 19:00
Modified
2024-08-03 10:37
Severity ?
EPSS score ?
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T10:37:42.183Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise",
"versions": [
{
"status": "unaffected",
"version": "ArubaOS 6.5.4.x: 6.5.4.23 and above; ArubaOS 8.6.x: 8.6.0.18 and above; ArubaOS 8.7.x: 8.7.1.10 and above; ArubaOS 8.10.x: 8.10.0.0 and above; ArubaOS 10.3.x: 10.3.0.1 and above; SD-WAN-2.3.0.x: 8.7.0.0-2.3.0.7 and above"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. \u003c/p\u003e"
}
],
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. \n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-12T12:11:04.548862Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "cveClient/1.0.13"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2022-37901",
"datePublished": "2022-11-03T19:00:12.293Z",
"dateReserved": "2022-08-08T18:45:22.550Z",
"dateUpdated": "2024-08-03T10:37:42.183Z",
"requesterUserId": "6707ad87-4508-4473-b324-feac48da5e14",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-22763
Vulnerability from cvelistv5
Published
2023-02-28 16:46
Modified
2024-08-02 10:20
Severity ?
EPSS score ?
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Hewlett Packard Enterprise (HPE) | Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central |
Version: ArubaOS 8.6.x.x: 8.6.0.19 and below Version: ArubaOS 8.10.x.x: 8.10.0.4 and below Version: ArubaOS 10.3.x.x: 10.3.1.0 and below Version: SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:20:30.355Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"status": "affected",
"version": "ArubaOS 8.6.x.x: 8.6.0.19 and below"
},
{
"status": "affected",
"version": "ArubaOS 8.10.x.x: 8.10.0.4 and below"
},
{
"status": "affected",
"version": "ArubaOS 10.3.x.x: 10.3.1.0 and below"
},
{
"status": "affected",
"version": "SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Erik de Jong (bugcrowd.com/erikdejong)"
}
],
"datePublic": "2023-02-28T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-01T05:45:13.020935Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated Remote Command Execution in the ArubaOS Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2023-22763",
"datePublished": "2023-02-28T16:46:58.281Z",
"dateReserved": "2023-01-06T15:24:20.505Z",
"dateUpdated": "2024-08-02T10:20:30.355Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-22764
Vulnerability from cvelistv5
Published
2023-02-28 16:47
Modified
2024-08-02 10:20
Severity ?
EPSS score ?
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Hewlett Packard Enterprise (HPE) | Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central |
Version: ArubaOS 8.6.x.x: 8.6.0.19 and below Version: ArubaOS 8.10.x.x: 8.10.0.4 and below Version: ArubaOS 10.3.x.x: 10.3.1.0 and below Version: SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:20:30.410Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"status": "affected",
"version": "ArubaOS 8.6.x.x: 8.6.0.19 and below"
},
{
"status": "affected",
"version": "ArubaOS 8.10.x.x: 8.10.0.4 and below"
},
{
"status": "affected",
"version": "ArubaOS 10.3.x.x: 10.3.1.0 and below"
},
{
"status": "affected",
"version": "SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Erik de Jong (bugcrowd.com/erikdejong)"
}
],
"datePublic": "2023-02-28T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-01T05:45:13.020935Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated Remote Command Execution in the ArubaOS Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2023-22764",
"datePublished": "2023-02-28T16:47:14.005Z",
"dateReserved": "2023-01-06T15:24:20.505Z",
"dateUpdated": "2024-08-02T10:20:30.410Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-37903
Vulnerability from cvelistv5
Published
2022-11-03 19:11
Modified
2024-08-03 10:37
Severity ?
EPSS score ?
Summary
A vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled content via the web interface. Successful exploitation of this vulnerability could lead to full compromise the underlying host operating system.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T10:37:42.505Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise",
"versions": [
{
"status": "unaffected",
"version": "ArubaOS 6.5.4.x: 6.5.4.23 and above; ArubaOS 8.6.x: 8.6.0.18 and above; ArubaOS 8.7.x: 8.7.1.10 and above; ArubaOS 8.10.x: 8.10.0.0 and above; ArubaOS 10.3.x: 10.3.0.1 and above; SD-WAN-2.3.0.x: 8.7.0.0-2.3.0.7 and above"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled content via the web interface. Successful exploitation of this vulnerability could lead to full compromise the underlying host operating system.\u003c/p\u003e"
}
],
"value": "A vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled content via the web interface. Successful exploitation of this vulnerability could lead to full compromise the underlying host operating system.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-12T12:11:04.548862Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "cveClient/1.0.13"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2022-37903",
"datePublished": "2022-11-03T19:11:02.155Z",
"dateReserved": "2022-08-08T18:45:22.550Z",
"dateUpdated": "2024-08-03T10:37:42.505Z",
"requesterUserId": "6707ad87-4508-4473-b324-feac48da5e14",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-37907
Vulnerability from cvelistv5
Published
2022-11-03 19:22
Modified
2024-08-03 10:37
Severity ?
EPSS score ?
Summary
A vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a denial of service (DoS) condition on an impacted system. A successful attacker can cause a system hang which can only be resolved via a power cycle of the impacted controller.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T10:37:41.865Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise",
"versions": [
{
"status": "unaffected",
"version": "ArubaOS 6.5.4.x: 6.5.4.23 and above; ArubaOS 8.6.x: 8.6.0.18 and above; ArubaOS 8.7.x: 8.7.1.10 and above; ArubaOS 8.10.x: 8.10.0.0 and above; ArubaOS 10.3.x: 10.3.0.1 and above; SD-WAN-2.3.0.x: 8.7.0.0-2.3.0.7 and above"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a denial of service (DoS) condition on an impacted system. A successful attacker can cause a system hang which can only be resolved via a power cycle of the impacted controller. \u003c/p\u003e"
}
],
"value": "A vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a denial of service (DoS) condition on an impacted system. A successful attacker can cause a system hang which can only be resolved via a power cycle of the impacted controller. \n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-12T12:11:04.548862Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "cveClient/1.0.13"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2022-37907",
"datePublished": "2022-11-03T19:22:49.990Z",
"dateReserved": "2022-08-08T18:45:22.551Z",
"dateUpdated": "2024-08-03T10:37:41.865Z",
"requesterUserId": "6707ad87-4508-4473-b324-feac48da5e14",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-24634
Vulnerability from cvelistv5
Published
2020-12-11 01:22
Modified
2024-08-04 15:19
Severity ?
EPSS score ?
Summary
An attacker is able to remotely inject arbitrary commands by sending especially crafted packets destined to the PAPI (Aruba Networks AP Management protocol) UDP port (8211) of access-pointsor controllers in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below ; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below.
References
| ▼ | URL | Tags |
|---|---|---|
| https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04072en_us | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | n/a | Aruba 9000 Gateway |
Version: 2.1.0.1 Version: 2.2.0.0 and below |
||||||||
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:19:09.075Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbnw04072en_us"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Aruba 9000 Gateway",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "2.1.0.1"
},
{
"status": "affected",
"version": "2.2.0.0 and below"
}
]
},
{
"product": "Aruba 7000 Series Mobility Controllers",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "6.4.4.23"
},
{
"status": "affected",
"version": "6.5.4.17"
},
{
"status": "affected",
"version": "8.2.2.9"
},
{
"status": "affected",
"version": "8.3.0.13"
},
{
"status": "affected",
"version": "8.5.0.10"
},
{
"status": "affected",
"version": "8.6.0.5"
},
{
"status": "affected",
"version": "8.7.0.0 and below"
}
]
},
{
"product": "Aruba 7200 Series Mobility Controllers",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "6.4.4.23"
},
{
"status": "affected",
"version": "6.5.4.17"
},
{
"status": "affected",
"version": "8.2.2.9"
},
{
"status": "affected",
"version": "8.3.0.13"
},
{
"status": "affected",
"version": "8.5.0.10"
},
{
"status": "affected",
"version": "8.6.0.5"
},
{
"status": "affected",
"version": "8.7.0.0 and below"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An attacker is able to remotely inject arbitrary commands by sending especially crafted packets destined to the PAPI (Aruba Networks AP Management protocol) UDP port (8211) of access-pointsor controllers in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below ; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "remote injection of arbitrary commands",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-11T01:22:50",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbnw04072en_us"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-alert@hpe.com",
"ID": "CVE-2020-24634",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Aruba 9000 Gateway",
"version": {
"version_data": [
{
"version_value": "2.1.0.1"
},
{
"version_value": "2.2.0.0 and below"
}
]
}
},
{
"product_name": "Aruba 7000 Series Mobility Controllers",
"version": {
"version_data": [
{
"version_value": "6.4.4.23"
},
{
"version_value": "6.5.4.17"
},
{
"version_value": "8.2.2.9"
},
{
"version_value": "8.3.0.13"
},
{
"version_value": "8.5.0.10"
},
{
"version_value": "8.6.0.5"
},
{
"version_value": "8.7.0.0 and below"
}
]
}
},
{
"product_name": "Aruba 7200 Series Mobility Controllers",
"version": {
"version_data": [
{
"version_value": "6.4.4.23"
},
{
"version_value": "6.5.4.17"
},
{
"version_value": "8.2.2.9"
},
{
"version_value": "8.3.0.13"
},
{
"version_value": "8.5.0.10"
},
{
"version_value": "8.6.0.5"
},
{
"version_value": "8.7.0.0 and below"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An attacker is able to remotely inject arbitrary commands by sending especially crafted packets destined to the PAPI (Aruba Networks AP Management protocol) UDP port (8211) of access-pointsor controllers in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below ; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "remote injection of arbitrary commands"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbnw04072en_us",
"refsource": "CONFIRM",
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbnw04072en_us"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2020-24634",
"datePublished": "2020-12-11T01:22:50",
"dateReserved": "2020-08-25T00:00:00",
"dateUpdated": "2024-08-04T15:19:09.075Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-22770
Vulnerability from cvelistv5
Published
2023-02-28 16:51
Modified
2024-08-02 10:20
Severity ?
EPSS score ?
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Hewlett Packard Enterprise (HPE) | Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central |
Version: ArubaOS 8.6.x.x: 8.6.0.19 and below Version: ArubaOS 8.10.x.x: 8.10.0.4 and below Version: ArubaOS 10.3.x.x: 10.3.1.0 and below Version: SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:20:30.354Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"status": "affected",
"version": "ArubaOS 8.6.x.x: 8.6.0.19 and below"
},
{
"status": "affected",
"version": "ArubaOS 8.10.x.x: 8.10.0.4 and below"
},
{
"status": "affected",
"version": "ArubaOS 10.3.x.x: 10.3.1.0 and below"
},
{
"status": "affected",
"version": "SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Erik de Jong (bugcrowd.com/erikdejong)"
}
],
"datePublic": "2023-02-28T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-01T05:45:13.020935Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated Remote Command Execution in the ArubaOS Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2023-22770",
"datePublished": "2023-02-28T16:51:02.255Z",
"dateReserved": "2023-01-06T15:24:20.507Z",
"dateUpdated": "2024-08-02T10:20:30.354Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-24633
Vulnerability from cvelistv5
Published
2020-12-11 01:26
Modified
2024-08-04 15:19
Severity ?
EPSS score ?
Summary
There are multiple buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending especially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211) of access-points or controllers in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below.
References
| ▼ | URL | Tags |
|---|---|---|
| https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04072en_us | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | n/a | Aruba 9000 Gateway |
Version: 2.1.0.1 Version: 2.2.0.0 and below |
||||||||
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:19:09.283Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbnw04072en_us"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Aruba 9000 Gateway",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "2.1.0.1"
},
{
"status": "affected",
"version": "2.2.0.0 and below"
}
]
},
{
"product": "Aruba 7000 Series Mobility Controllers",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "6.4.4.23"
},
{
"status": "affected",
"version": "6.5.4.17"
},
{
"status": "affected",
"version": "8.2.2.9"
},
{
"status": "affected",
"version": "8.3.0.13"
},
{
"status": "affected",
"version": "8.5.0.10"
},
{
"status": "affected",
"version": "8.6.0.5"
},
{
"status": "affected",
"version": "8.7.0.0 and below"
}
]
},
{
"product": "Aruba 7200 Series Mobility Controllers",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "6.4.4.23"
},
{
"status": "affected",
"version": "6.5.4.17"
},
{
"status": "affected",
"version": "8.2.2.9"
},
{
"status": "affected",
"version": "8.3.0.13"
},
{
"status": "affected",
"version": "8.5.0.10"
},
{
"status": "affected",
"version": "8.6.0.5"
},
{
"status": "affected",
"version": "8.7.0.0 and below"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "There are multiple buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending especially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211) of access-points or controllers in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "remote buffer overflow",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-11T01:26:14",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbnw04072en_us"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-alert@hpe.com",
"ID": "CVE-2020-24633",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Aruba 9000 Gateway",
"version": {
"version_data": [
{
"version_value": "2.1.0.1"
},
{
"version_value": "2.2.0.0 and below"
}
]
}
},
{
"product_name": "Aruba 7000 Series Mobility Controllers",
"version": {
"version_data": [
{
"version_value": "6.4.4.23"
},
{
"version_value": "6.5.4.17"
},
{
"version_value": "8.2.2.9"
},
{
"version_value": "8.3.0.13"
},
{
"version_value": "8.5.0.10"
},
{
"version_value": "8.6.0.5"
},
{
"version_value": "8.7.0.0 and below"
}
]
}
},
{
"product_name": "Aruba 7200 Series Mobility Controllers",
"version": {
"version_data": [
{
"version_value": "6.4.4.23"
},
{
"version_value": "6.5.4.17"
},
{
"version_value": "8.2.2.9"
},
{
"version_value": "8.3.0.13"
},
{
"version_value": "8.5.0.10"
},
{
"version_value": "8.6.0.5"
},
{
"version_value": "8.7.0.0 and below"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "There are multiple buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending especially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211) of access-points or controllers in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "remote buffer overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbnw04072en_us",
"refsource": "CONFIRM",
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbnw04072en_us"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2020-24633",
"datePublished": "2020-12-11T01:26:14",
"dateReserved": "2020-08-25T00:00:00",
"dateUpdated": "2024-08-04T15:19:09.283Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-22773
Vulnerability from cvelistv5
Published
2023-02-28 16:56
Modified
2024-08-02 10:20
Severity ?
EPSS score ?
Summary
Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files in the underlying operating system.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Hewlett Packard Enterprise (HPE) | Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central |
Version: ArubaOS 8.6.x.x: 8.6.0.19 and below Version: ArubaOS 8.10.x.x: 8.10.0.4 and below Version: ArubaOS 10.3.x.x: 10.3.1.0 and below Version: SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:20:30.673Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"status": "affected",
"version": "ArubaOS 8.6.x.x: 8.6.0.19 and below"
},
{
"status": "affected",
"version": "ArubaOS 8.10.x.x: 8.10.0.4 and below"
},
{
"status": "affected",
"version": "ArubaOS 10.3.x.x: 10.3.1.0 and below"
},
{
"status": "affected",
"version": "SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Erik de Jong (bugcrowd.com/erikdejong)"
}
],
"datePublic": "2023-02-28T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files in the underlying operating system.\u003cbr\u003e"
}
],
"value": "Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files in the underlying operating system.\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-01T05:45:13.020935Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated Path Traversal in ArubaOS Command Line Interface Allows for Arbitrary File Deletion.",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2023-22773",
"datePublished": "2023-02-28T16:56:44.883Z",
"dateReserved": "2023-01-06T15:24:20.508Z",
"dateUpdated": "2024-08-02T10:20:30.673Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-37899
Vulnerability from cvelistv5
Published
2022-11-03 18:44
Modified
2024-08-03 10:37
Severity ?
EPSS score ?
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T10:37:42.537Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise",
"versions": [
{
"status": "unaffected",
"version": "ArubaOS 6.5.4.x: 6.5.4.23 and above; ArubaOS 8.6.x: 8.6.0.18 and above; ArubaOS 8.7.x: 8.7.1.10 and above; ArubaOS 8.10.x: 8.10.0.0 and above; ArubaOS 10.3.x: 10.3.0.1 and above; SD-WAN-2.3.0.x: 8.7.0.0-2.3.0.7 and above"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. \u003c/p\u003e"
}
],
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. \n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-12T12:11:04.548862Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "cveClient/1.0.13"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2022-37899",
"datePublished": "2022-11-03T18:44:51.309Z",
"dateReserved": "2022-08-08T18:45:22.549Z",
"dateUpdated": "2024-08-03T10:37:42.537Z",
"requesterUserId": "6707ad87-4508-4473-b324-feac48da5e14",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-22769
Vulnerability from cvelistv5
Published
2023-02-28 16:50
Modified
2024-08-02 10:20
Severity ?
EPSS score ?
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Hewlett Packard Enterprise (HPE) | Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central |
Version: ArubaOS 8.6.x.x: 8.6.0.19 and below Version: ArubaOS 8.10.x.x: 8.10.0.4 and below Version: ArubaOS 10.3.x.x: 10.3.1.0 and below Version: SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:20:31.068Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"status": "affected",
"version": "ArubaOS 8.6.x.x: 8.6.0.19 and below"
},
{
"status": "affected",
"version": "ArubaOS 8.10.x.x: 8.10.0.4 and below"
},
{
"status": "affected",
"version": "ArubaOS 10.3.x.x: 10.3.1.0 and below"
},
{
"status": "affected",
"version": "SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Erik de Jong (bugcrowd.com/erikdejong)"
}
],
"datePublic": "2023-02-28T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-01T05:45:13.020935Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated Remote Command Execution in the ArubaOS Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2023-22769",
"datePublished": "2023-02-28T16:50:46.657Z",
"dateReserved": "2023-01-06T15:24:20.506Z",
"dateUpdated": "2024-08-02T10:20:31.068Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-22774
Vulnerability from cvelistv5
Published
2023-02-28 16:57
Modified
2024-08-02 10:20
Severity ?
EPSS score ?
Summary
Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files in the underlying operating system.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Hewlett Packard Enterprise (HPE) | Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central |
Version: ArubaOS 8.6.x.x: 8.6.0.19 and below Version: ArubaOS 8.10.x.x: 8.10.0.4 and below Version: ArubaOS 10.3.x.x: 10.3.1.0 and below Version: SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:20:31.081Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"status": "affected",
"version": "ArubaOS 8.6.x.x: 8.6.0.19 and below"
},
{
"status": "affected",
"version": "ArubaOS 8.10.x.x: 8.10.0.4 and below"
},
{
"status": "affected",
"version": "ArubaOS 10.3.x.x: 10.3.1.0 and below"
},
{
"status": "affected",
"version": "SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Erik de Jong (bugcrowd.com/erikdejong)"
}
],
"datePublic": "2023-02-28T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files in the underlying operating system.\u003cbr\u003e"
}
],
"value": "Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files in the underlying operating system.\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-01T05:45:13.020935Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated Path Traversal in ArubaOS Command Line Interface Allows for Arbitrary File Deletion.",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2023-22774",
"datePublished": "2023-02-28T16:57:05.728Z",
"dateReserved": "2023-01-06T15:24:20.508Z",
"dateUpdated": "2024-08-02T10:20:31.081Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-37905
Vulnerability from cvelistv5
Published
2022-11-03 19:15
Modified
2024-08-03 10:37
Severity ?
EPSS score ?
Summary
Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T10:37:41.852Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise",
"versions": [
{
"status": "unaffected",
"version": "ArubaOS 6.5.4.x: 6.5.4.23 and above; ArubaOS 8.6.x: 8.6.0.18 and above; ArubaOS 8.7.x: 8.7.1.10 and above; ArubaOS 8.10.x: 8.10.0.0 and above; ArubaOS 10.3.x: 10.3.0.1 and above; SD-WAN-2.3.0.x: 8.7.0.0-2.3.0.7 and above"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eVulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.\u003c/p\u003e"
}
],
"value": "Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-12T12:11:04.548862Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "cveClient/1.0.13"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2022-37905",
"datePublished": "2022-11-03T19:15:18.208Z",
"dateReserved": "2022-08-08T18:45:22.551Z",
"dateUpdated": "2024-08-03T10:37:41.852Z",
"requesterUserId": "6707ad87-4508-4473-b324-feac48da5e14",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-37904
Vulnerability from cvelistv5
Published
2022-11-03 19:13
Modified
2024-08-03 10:37
Severity ?
EPSS score ?
Summary
Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T10:37:41.950Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise",
"versions": [
{
"status": "unaffected",
"version": "ArubaOS 6.5.4.x: 6.5.4.23 and above; ArubaOS 8.6.x: 8.6.0.18 and above; ArubaOS 8.7.x: 8.7.1.10 and above; ArubaOS 8.10.x: 8.10.0.0 and above; ArubaOS 10.3.x: 10.3.0.1 and above; SD-WAN-2.3.0.x: 8.7.0.0-2.3.0.7 and above"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eVulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.\u003c/p\u003e"
}
],
"value": "Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-12T12:11:04.548862Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "cveClient/1.0.13"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2022-37904",
"datePublished": "2022-11-03T19:13:52.272Z",
"dateReserved": "2022-08-08T18:45:22.551Z",
"dateUpdated": "2024-08-03T10:37:41.950Z",
"requesterUserId": "6707ad87-4508-4473-b324-feac48da5e14",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-22768
Vulnerability from cvelistv5
Published
2023-02-28 16:49
Modified
2024-08-02 10:20
Severity ?
EPSS score ?
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Hewlett Packard Enterprise (HPE) | Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central |
Version: ArubaOS 8.6.x.x: 8.6.0.19 and below Version: ArubaOS 8.10.x.x: 8.10.0.4 and below Version: ArubaOS 10.3.x.x: 10.3.1.0 and below Version: SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:20:30.402Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"status": "affected",
"version": "ArubaOS 8.6.x.x: 8.6.0.19 and below"
},
{
"status": "affected",
"version": "ArubaOS 8.10.x.x: 8.10.0.4 and below"
},
{
"status": "affected",
"version": "ArubaOS 10.3.x.x: 10.3.1.0 and below"
},
{
"status": "affected",
"version": "SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Daniel Jensen (@dozernz)"
}
],
"datePublic": "2023-02-28T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-01T05:45:13.020935Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated Remote Command Execution in the ArubaOS Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2023-22768",
"datePublished": "2023-02-28T16:49:39.531Z",
"dateReserved": "2023-01-06T15:24:20.506Z",
"dateUpdated": "2024-08-02T10:20:30.402Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-37902
Vulnerability from cvelistv5
Published
2022-11-03 19:05
Modified
2024-08-03 10:37
Severity ?
EPSS score ?
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T10:37:41.938Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise",
"versions": [
{
"status": "unaffected",
"version": "ArubaOS 6.5.4.x: 6.5.4.23 and above; ArubaOS 8.6.x: 8.6.0.18 and above; ArubaOS 8.7.x: 8.7.1.10 and above; ArubaOS 8.10.x: 8.10.0.0 and above; ArubaOS 10.3.x: 10.3.0.1 and above; SD-WAN-2.3.0.x: 8.7.0.0-2.3.0.7 and above"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. \u003c/p\u003e"
}
],
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. \n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-12T12:11:04.548862Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "cveClient/1.0.13"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2022-37902",
"datePublished": "2022-11-03T19:05:52.628Z",
"dateReserved": "2022-08-08T18:45:22.550Z",
"dateUpdated": "2024-08-03T10:37:41.938Z",
"requesterUserId": "6707ad87-4508-4473-b324-feac48da5e14",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2023-03-01 08:15
Modified
2024-11-21 07:45
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "83AF7A4D-4169-47A8-A6BD-70C2AEB5E199",
"versionEndIncluding": "8.6.0.19",
"versionStartIncluding": "8.6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB80251-B38D-4145-89E8-FFBFB653D8A4",
"versionEndIncluding": "8.10.0.4",
"versionStartIncluding": "8.10.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E9226A2A-7048-4300-AC20-7629AA05E9D9",
"versionEndIncluding": "10.3.1.0",
"versionStartIncluding": "10.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA13FF5-7C60-48B4-AF46-18A9F19D5D42",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0B1EB3D9-77B5-4DBE-9518-23DD0DA06BC9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17162DB3-973E-47C6-9157-39A0E94603F2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-10:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F10CF160-4F83-452D-9BA5-E8DCA1A15ABB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E729365A-B367-474E-BD7D-8437AD47D9B1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-250:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5FDDD143-B396-4C58-9FB9-BA4C3B8B953E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD639D9E-2722-47EF-94F0-2CAF9E94EFD4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA9CA7B-AC2C-408A-B759-E2F4778B20ED",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "38A42369-3558-4015-AF7B-7F2E2465AE61",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E0D8DDC4-17FB-4A9D-BB01-E8C130B04ED2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B47572BC-93F8-4E53-B2B7-E00855B59499",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D80337C7-2A72-4E09-858B-0AA817D70746",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "670224DA-CE4B-46BE-8B5C-2F310F7988B4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59B86FAE-2D7E-4B30-835A-C3D37A361A29",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6DE3DC2D-7C6E-4044-AAB7-75FA5451AA56",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7940F80-A647-488F-95D7-FBBB46CD5100",
"versionEndIncluding": "8.7.0.0-2.3.0.8",
"versionStartIncluding": "8.7.0.0-2.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n"
}
],
"id": "CVE-2023-22764",
"lastModified": "2024-11-21T07:45:22.847",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "security-alert@hpe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-03-01T08:15:13.573",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-12-12 13:15
Modified
2024-11-21 07:15
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| arubanetworks | sd-wan | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | 10.3.0.0 | |
| arubanetworks | 7005 | - | |
| arubanetworks | 7008 | - | |
| arubanetworks | 7010 | - | |
| arubanetworks | 7024 | - | |
| arubanetworks | 7030 | - | |
| arubanetworks | 7205 | - | |
| arubanetworks | 7210 | - | |
| arubanetworks | 7220 | - | |
| arubanetworks | 7240xm | - | |
| arubanetworks | 7280 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0103D83D-C5A8-4F59-B5AF-B6F39A3F613F",
"versionEndExcluding": "8.7.0.0-2.3.0.7",
"versionStartIncluding": "8.7.0.0-2.3.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "174292ED-9C76-4815-8DBA-E83CB1A59E96",
"versionEndExcluding": "6.5.4.23",
"versionStartIncluding": "6.5.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "28D7A806-4AB8-49DD-91D0-E81E3B4FD468",
"versionEndExcluding": "8.6.0.18",
"versionStartIncluding": "8.4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F6E4F019-F048-4E6C-9EC7-B9B6A776C246",
"versionEndExcluding": "8.7.1.10",
"versionStartIncluding": "8.7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0AAF010C-30AB-43D2-BAAB-813B869675FB",
"versionEndIncluding": "8.9.0.3",
"versionStartIncluding": "8.8.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84A36EB0-A525-4B05-B9CE-A31145A7157C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7005:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FE128072-9444-40D5-AC86-BB317869EB97",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7008:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F747F71E-66BC-4776-BCCC-3123F8EEEBC6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "15FE873C-3C45-4EA3-9AD1-D07F132BC31F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. \n\n"
},
{
"lang": "es",
"value": "Existen vulnerabilidades de inyecci\u00f3n de comandos autenticadas en la interfaz de l\u00ednea de comandos de ArubaOS. La explotaci\u00f3n exitosa de estas vulnerabilidades da como resultado la capacidad de ejecutar comandos arbitrarios como usuario privilegiado en el sistema operativo subyacente."
}
],
"id": "CVE-2022-37902",
"lastModified": "2024-11-21T07:15:20.840",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "security-alert@hpe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-12-12T13:15:12.797",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-03-01 08:15
Modified
2024-11-21 07:45
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "83AF7A4D-4169-47A8-A6BD-70C2AEB5E199",
"versionEndIncluding": "8.6.0.19",
"versionStartIncluding": "8.6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB80251-B38D-4145-89E8-FFBFB653D8A4",
"versionEndIncluding": "8.10.0.4",
"versionStartIncluding": "8.10.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E9226A2A-7048-4300-AC20-7629AA05E9D9",
"versionEndIncluding": "10.3.1.0",
"versionStartIncluding": "10.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA13FF5-7C60-48B4-AF46-18A9F19D5D42",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0B1EB3D9-77B5-4DBE-9518-23DD0DA06BC9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17162DB3-973E-47C6-9157-39A0E94603F2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-10:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F10CF160-4F83-452D-9BA5-E8DCA1A15ABB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E729365A-B367-474E-BD7D-8437AD47D9B1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-250:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5FDDD143-B396-4C58-9FB9-BA4C3B8B953E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD639D9E-2722-47EF-94F0-2CAF9E94EFD4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA9CA7B-AC2C-408A-B759-E2F4778B20ED",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "38A42369-3558-4015-AF7B-7F2E2465AE61",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E0D8DDC4-17FB-4A9D-BB01-E8C130B04ED2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B47572BC-93F8-4E53-B2B7-E00855B59499",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D80337C7-2A72-4E09-858B-0AA817D70746",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "670224DA-CE4B-46BE-8B5C-2F310F7988B4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59B86FAE-2D7E-4B30-835A-C3D37A361A29",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6DE3DC2D-7C6E-4044-AAB7-75FA5451AA56",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7940F80-A647-488F-95D7-FBBB46CD5100",
"versionEndIncluding": "8.7.0.0-2.3.0.8",
"versionStartIncluding": "8.7.0.0-2.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n"
}
],
"id": "CVE-2023-22762",
"lastModified": "2024-11-21T07:45:22.603",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "security-alert@hpe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-03-01T08:15:13.433",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-12-12 13:15
Modified
2024-11-21 07:15
Severity ?
5.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
A vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a denial of service (DoS) condition on an impacted system. A successful attacker can cause a system hang which can only be resolved via a power cycle of the impacted controller.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| arubanetworks | sd-wan | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | 7005 | - | |
| arubanetworks | 7008 | - | |
| arubanetworks | 7010 | - | |
| arubanetworks | 7024 | - | |
| arubanetworks | 7030 | - | |
| arubanetworks | 7205 | - | |
| arubanetworks | 7210 | - | |
| arubanetworks | 7220 | - | |
| arubanetworks | 7240xm | - | |
| arubanetworks | 7280 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4CF50C4E-038A-4120-BF86-05DF607C59CB",
"versionEndExcluding": "8.7.0.0-2.3.0.6",
"versionStartIncluding": "8.7.0.0-2.3.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "49CE5580-518E-4CC8-894A-A78F476D6EC7",
"versionEndExcluding": "6.5.4.22",
"versionStartIncluding": "6.5.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "58A7807B-5AD1-4CE1-8974-772067778D97",
"versionEndExcluding": "8.6.0.17",
"versionStartIncluding": "8.4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F077A2FC-EE0D-4D8F-A5E1-A1BE3285EFDD",
"versionEndExcluding": "8.7.1.9",
"versionStartIncluding": "8.7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8E3B42F6-8255-411C-8E0D-9992F3C5F633",
"versionEndExcluding": "10.3.0.1",
"versionStartIncluding": "8.8.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7005:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FE128072-9444-40D5-AC86-BB317869EB97",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7008:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F747F71E-66BC-4776-BCCC-3123F8EEEBC6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "15FE873C-3C45-4EA3-9AD1-D07F132BC31F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a denial of service (DoS) condition on an impacted system. A successful attacker can cause a system hang which can only be resolved via a power cycle of the impacted controller. \n\n"
},
{
"lang": "es",
"value": "Existe una vulnerabilidad en bootloader de ArubaOS en los controladores de la serie 7xxx que puede provocar una condici\u00f3n de Denegaci\u00f3n de Servicio (DoS) en un sistema afectado. Un atacante exitoso puede causar un bloqueo del sistema que solo puede resolverse mediante un ciclo de encendido del controlador afectado."
}
],
"id": "CVE-2022-37907",
"lastModified": "2024-11-21T07:15:21.517",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.3,
"impactScore": 4.0,
"source": "security-alert@hpe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-12-12T13:15:13.120",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-12-12 13:15
Modified
2024-11-21 07:15
Severity ?
6.6 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| arubanetworks | sd-wan | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | 10.3.0.0 | |
| arubanetworks | 7005 | - | |
| arubanetworks | 7008 | - | |
| arubanetworks | 7010 | - | |
| arubanetworks | 7024 | - | |
| arubanetworks | 7030 | - | |
| arubanetworks | 7205 | - | |
| arubanetworks | 7210 | - | |
| arubanetworks | 7220 | - | |
| arubanetworks | 7240xm | - | |
| arubanetworks | 7280 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4CF50C4E-038A-4120-BF86-05DF607C59CB",
"versionEndExcluding": "8.7.0.0-2.3.0.6",
"versionStartIncluding": "8.7.0.0-2.3.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "49CE5580-518E-4CC8-894A-A78F476D6EC7",
"versionEndExcluding": "6.5.4.22",
"versionStartIncluding": "6.5.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "58A7807B-5AD1-4CE1-8974-772067778D97",
"versionEndExcluding": "8.6.0.17",
"versionStartIncluding": "8.4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F077A2FC-EE0D-4D8F-A5E1-A1BE3285EFDD",
"versionEndExcluding": "8.7.1.9",
"versionStartIncluding": "8.7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0AAF010C-30AB-43D2-BAAB-813B869675FB",
"versionEndIncluding": "8.9.0.3",
"versionStartIncluding": "8.8.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84A36EB0-A525-4B05-B9CE-A31145A7157C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7005:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FE128072-9444-40D5-AC86-BB317869EB97",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7008:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F747F71E-66BC-4776-BCCC-3123F8EEEBC6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "15FE873C-3C45-4EA3-9AD1-D07F132BC31F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.\n\n"
},
{
"lang": "es",
"value": "Existen vulnerabilidades en ArubaOS que se ejecutan en controladores de la serie 7xxx que permiten a un atacante ejecutar c\u00f3digo arbitrario durante la secuencia de inicio. La explotaci\u00f3n exitosa podr\u00eda permitir a un atacante lograr una modificaci\u00f3n permanente del sistema operativo subyacente."
}
],
"id": "CVE-2022-37905",
"lastModified": "2024-11-21T07:15:21.260",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 0.7,
"impactScore": 5.9,
"source": "security-alert@hpe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-12-12T13:15:12.990",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-12-11 02:15
Modified
2024-11-21 05:15
Severity ?
Summary
Two vulnerabilities in ArubaOS GRUB2 implementation allows for an attacker to bypass secureboot. Successful exploitation of this vulnerability this could lead to remote compromise of system integrity by allowing an attacker to load an untrusted or modified kernel in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below ; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | 7005 | - | |
| arubanetworks | 7008 | - | |
| arubanetworks | 7010 | - | |
| arubanetworks | 7024 | - | |
| arubanetworks | 7030 | - | |
| arubanetworks | 7205 | - | |
| arubanetworks | 7210 | - | |
| arubanetworks | 7220 | - | |
| arubanetworks | 7240xm | - | |
| arubanetworks | 7280 | - | |
| arubanetworks | sd-wan | * | |
| arubanetworks | sd-wan | * | |
| arubanetworks | 9004 | - | |
| arubanetworks | 9004-lte | - | |
| arubanetworks | 9012 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "54105104-BEC9-4E17-BE32-96F2111310F1",
"versionEndExcluding": "8.5.0.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C6A4597E-0267-4DA8-BFFB-513BEA7D04D4",
"versionEndExcluding": "8.6.0.6",
"versionStartIncluding": "8.6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "894088FF-5838-4CE7-AA31-CE7FB247E271",
"versionEndExcluding": "8.7.1.0",
"versionStartIncluding": "8.7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7005:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FE128072-9444-40D5-AC86-BB317869EB97",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7008:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F747F71E-66BC-4776-BCCC-3123F8EEEBC6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "15FE873C-3C45-4EA3-9AD1-D07F132BC31F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A206DE28-E15A-437B-BC1C-261F32F24F3A",
"versionEndExcluding": "2.1.0.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A1D1957E-1DFE-495B-8DF5-C1640857DDF4",
"versionEndExcluding": "2.2.0.1",
"versionStartIncluding": "2.2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA13FF5-7C60-48B4-AF46-18A9F19D5D42",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0B1EB3D9-77B5-4DBE-9518-23DD0DA06BC9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17162DB3-973E-47C6-9157-39A0E94603F2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Two vulnerabilities in ArubaOS GRUB2 implementation allows for an attacker to bypass secureboot. Successful exploitation of this vulnerability this could lead to remote compromise of system integrity by allowing an attacker to load an untrusted or modified kernel in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below ; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below."
},
{
"lang": "es",
"value": "Dos vulnerabilidades en la implementaci\u00f3n de ArubaOS GRUB2 permiten a un atacante omitir el arranque seguro.\u0026#xa0;Una explotaci\u00f3n con \u00e9xito de esta vulnerabilidad podr\u00eda conllevar a un compromiso remoto de la integridad del sistema al permitir a un atacante cargar un kernel modificado o no confiable en Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers versiones: 2.1.0.1, 2.2.0.0 y anteriores;\u0026#xa0;6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 y por debajo;\u0026#xa0;6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 y por debajo"
}
],
"id": "CVE-2020-24637",
"lastModified": "2024-11-21T05:15:18.577",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-12-11T02:15:11.117",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbnw04072en_us"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbnw04072en_us"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-03-01 08:15
Modified
2024-11-21 07:45
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "83AF7A4D-4169-47A8-A6BD-70C2AEB5E199",
"versionEndIncluding": "8.6.0.19",
"versionStartIncluding": "8.6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB80251-B38D-4145-89E8-FFBFB653D8A4",
"versionEndIncluding": "8.10.0.4",
"versionStartIncluding": "8.10.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E9226A2A-7048-4300-AC20-7629AA05E9D9",
"versionEndIncluding": "10.3.1.0",
"versionStartIncluding": "10.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA13FF5-7C60-48B4-AF46-18A9F19D5D42",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0B1EB3D9-77B5-4DBE-9518-23DD0DA06BC9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17162DB3-973E-47C6-9157-39A0E94603F2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-10:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F10CF160-4F83-452D-9BA5-E8DCA1A15ABB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E729365A-B367-474E-BD7D-8437AD47D9B1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-250:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5FDDD143-B396-4C58-9FB9-BA4C3B8B953E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD639D9E-2722-47EF-94F0-2CAF9E94EFD4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA9CA7B-AC2C-408A-B759-E2F4778B20ED",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "38A42369-3558-4015-AF7B-7F2E2465AE61",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E0D8DDC4-17FB-4A9D-BB01-E8C130B04ED2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B47572BC-93F8-4E53-B2B7-E00855B59499",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D80337C7-2A72-4E09-858B-0AA817D70746",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "670224DA-CE4B-46BE-8B5C-2F310F7988B4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59B86FAE-2D7E-4B30-835A-C3D37A361A29",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6DE3DC2D-7C6E-4044-AAB7-75FA5451AA56",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7940F80-A647-488F-95D7-FBBB46CD5100",
"versionEndIncluding": "8.7.0.0-2.3.0.8",
"versionStartIncluding": "8.7.0.0-2.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n"
}
],
"id": "CVE-2023-22763",
"lastModified": "2024-11-21T07:45:22.727",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "security-alert@hpe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-03-01T08:15:13.500",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-03-01 08:15
Modified
2024-11-21 07:45
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "83AF7A4D-4169-47A8-A6BD-70C2AEB5E199",
"versionEndIncluding": "8.6.0.19",
"versionStartIncluding": "8.6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB80251-B38D-4145-89E8-FFBFB653D8A4",
"versionEndIncluding": "8.10.0.4",
"versionStartIncluding": "8.10.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E9226A2A-7048-4300-AC20-7629AA05E9D9",
"versionEndIncluding": "10.3.1.0",
"versionStartIncluding": "10.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA13FF5-7C60-48B4-AF46-18A9F19D5D42",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0B1EB3D9-77B5-4DBE-9518-23DD0DA06BC9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17162DB3-973E-47C6-9157-39A0E94603F2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-10:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F10CF160-4F83-452D-9BA5-E8DCA1A15ABB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E729365A-B367-474E-BD7D-8437AD47D9B1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-250:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5FDDD143-B396-4C58-9FB9-BA4C3B8B953E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD639D9E-2722-47EF-94F0-2CAF9E94EFD4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA9CA7B-AC2C-408A-B759-E2F4778B20ED",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "38A42369-3558-4015-AF7B-7F2E2465AE61",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E0D8DDC4-17FB-4A9D-BB01-E8C130B04ED2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B47572BC-93F8-4E53-B2B7-E00855B59499",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D80337C7-2A72-4E09-858B-0AA817D70746",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "670224DA-CE4B-46BE-8B5C-2F310F7988B4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59B86FAE-2D7E-4B30-835A-C3D37A361A29",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6DE3DC2D-7C6E-4044-AAB7-75FA5451AA56",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7940F80-A647-488F-95D7-FBBB46CD5100",
"versionEndIncluding": "8.7.0.0-2.3.0.8",
"versionStartIncluding": "8.7.0.0-2.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n"
}
],
"id": "CVE-2023-22765",
"lastModified": "2024-11-21T07:45:22.970",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "security-alert@hpe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-03-01T08:15:13.637",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-03-01 08:15
Modified
2024-11-21 07:45
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Summary
Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files in the underlying operating system.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "83AF7A4D-4169-47A8-A6BD-70C2AEB5E199",
"versionEndIncluding": "8.6.0.19",
"versionStartIncluding": "8.6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB80251-B38D-4145-89E8-FFBFB653D8A4",
"versionEndIncluding": "8.10.0.4",
"versionStartIncluding": "8.10.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E9226A2A-7048-4300-AC20-7629AA05E9D9",
"versionEndIncluding": "10.3.1.0",
"versionStartIncluding": "10.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA13FF5-7C60-48B4-AF46-18A9F19D5D42",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0B1EB3D9-77B5-4DBE-9518-23DD0DA06BC9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17162DB3-973E-47C6-9157-39A0E94603F2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-10:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F10CF160-4F83-452D-9BA5-E8DCA1A15ABB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E729365A-B367-474E-BD7D-8437AD47D9B1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-250:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5FDDD143-B396-4C58-9FB9-BA4C3B8B953E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD639D9E-2722-47EF-94F0-2CAF9E94EFD4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA9CA7B-AC2C-408A-B759-E2F4778B20ED",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "38A42369-3558-4015-AF7B-7F2E2465AE61",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E0D8DDC4-17FB-4A9D-BB01-E8C130B04ED2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B47572BC-93F8-4E53-B2B7-E00855B59499",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D80337C7-2A72-4E09-858B-0AA817D70746",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "670224DA-CE4B-46BE-8B5C-2F310F7988B4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59B86FAE-2D7E-4B30-835A-C3D37A361A29",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6DE3DC2D-7C6E-4044-AAB7-75FA5451AA56",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7940F80-A647-488F-95D7-FBBB46CD5100",
"versionEndIncluding": "8.7.0.0-2.3.0.8",
"versionStartIncluding": "8.7.0.0-2.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files in the underlying operating system.\n"
}
],
"id": "CVE-2023-22773",
"lastModified": "2024-11-21T07:45:23.937",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "security-alert@hpe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-03-01T08:15:14.167",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-12-12 13:15
Modified
2024-11-21 07:15
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| arubanetworks | sd-wan | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | 10.3.0.0 | |
| arubanetworks | 7005 | - | |
| arubanetworks | 7008 | - | |
| arubanetworks | 7010 | - | |
| arubanetworks | 7024 | - | |
| arubanetworks | 7030 | - | |
| arubanetworks | 7205 | - | |
| arubanetworks | 7210 | - | |
| arubanetworks | 7220 | - | |
| arubanetworks | 7240xm | - | |
| arubanetworks | 7280 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0103D83D-C5A8-4F59-B5AF-B6F39A3F613F",
"versionEndExcluding": "8.7.0.0-2.3.0.7",
"versionStartIncluding": "8.7.0.0-2.3.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "174292ED-9C76-4815-8DBA-E83CB1A59E96",
"versionEndExcluding": "6.5.4.23",
"versionStartIncluding": "6.5.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "28D7A806-4AB8-49DD-91D0-E81E3B4FD468",
"versionEndExcluding": "8.6.0.18",
"versionStartIncluding": "8.4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F6E4F019-F048-4E6C-9EC7-B9B6A776C246",
"versionEndExcluding": "8.7.1.10",
"versionStartIncluding": "8.7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0AAF010C-30AB-43D2-BAAB-813B869675FB",
"versionEndIncluding": "8.9.0.3",
"versionStartIncluding": "8.8.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84A36EB0-A525-4B05-B9CE-A31145A7157C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7005:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FE128072-9444-40D5-AC86-BB317869EB97",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7008:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F747F71E-66BC-4776-BCCC-3123F8EEEBC6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "15FE873C-3C45-4EA3-9AD1-D07F132BC31F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. \n\n"
},
{
"lang": "es",
"value": "Existen vulnerabilidades de inyecci\u00f3n de comandos autenticadas en la interfaz de l\u00ednea de comandos de ArubaOS. La explotaci\u00f3n exitosa de estas vulnerabilidades da como resultado la capacidad de ejecutar comandos arbitrarios como usuario privilegiado en el sistema operativo subyacente."
}
],
"id": "CVE-2022-37898",
"lastModified": "2024-11-21T07:15:20.253",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "security-alert@hpe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-12-12T13:15:12.547",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-12-12 13:15
Modified
2024-11-21 07:15
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| arubanetworks | sd-wan | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | 10.3.0.0 | |
| arubanetworks | 7005 | - | |
| arubanetworks | 7008 | - | |
| arubanetworks | 7010 | - | |
| arubanetworks | 7024 | - | |
| arubanetworks | 7030 | - | |
| arubanetworks | 7205 | - | |
| arubanetworks | 7210 | - | |
| arubanetworks | 7220 | - | |
| arubanetworks | 7240xm | - | |
| arubanetworks | 7280 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0103D83D-C5A8-4F59-B5AF-B6F39A3F613F",
"versionEndExcluding": "8.7.0.0-2.3.0.7",
"versionStartIncluding": "8.7.0.0-2.3.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "174292ED-9C76-4815-8DBA-E83CB1A59E96",
"versionEndExcluding": "6.5.4.23",
"versionStartIncluding": "6.5.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "28D7A806-4AB8-49DD-91D0-E81E3B4FD468",
"versionEndExcluding": "8.6.0.18",
"versionStartIncluding": "8.4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F6E4F019-F048-4E6C-9EC7-B9B6A776C246",
"versionEndExcluding": "8.7.1.10",
"versionStartIncluding": "8.7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0AAF010C-30AB-43D2-BAAB-813B869675FB",
"versionEndIncluding": "8.9.0.3",
"versionStartIncluding": "8.8.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84A36EB0-A525-4B05-B9CE-A31145A7157C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7005:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FE128072-9444-40D5-AC86-BB317869EB97",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7008:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F747F71E-66BC-4776-BCCC-3123F8EEEBC6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "15FE873C-3C45-4EA3-9AD1-D07F132BC31F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. \n\n"
},
{
"lang": "es",
"value": "Existen vulnerabilidades de inyecci\u00f3n de comandos autenticadas en la interfaz de l\u00ednea de comandos de ArubaOS. La explotaci\u00f3n exitosa de estas vulnerabilidades da como resultado la capacidad de ejecutar comandos arbitrarios como usuario privilegiado en el sistema operativo subyacente."
}
],
"id": "CVE-2022-37899",
"lastModified": "2024-11-21T07:15:20.400",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "security-alert@hpe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-12-12T13:15:12.617",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-03-01 08:15
Modified
2024-11-21 07:45
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Summary
Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files in the underlying operating system.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "83AF7A4D-4169-47A8-A6BD-70C2AEB5E199",
"versionEndIncluding": "8.6.0.19",
"versionStartIncluding": "8.6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB80251-B38D-4145-89E8-FFBFB653D8A4",
"versionEndIncluding": "8.10.0.4",
"versionStartIncluding": "8.10.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E9226A2A-7048-4300-AC20-7629AA05E9D9",
"versionEndIncluding": "10.3.1.0",
"versionStartIncluding": "10.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA13FF5-7C60-48B4-AF46-18A9F19D5D42",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0B1EB3D9-77B5-4DBE-9518-23DD0DA06BC9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17162DB3-973E-47C6-9157-39A0E94603F2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-10:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F10CF160-4F83-452D-9BA5-E8DCA1A15ABB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E729365A-B367-474E-BD7D-8437AD47D9B1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-250:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5FDDD143-B396-4C58-9FB9-BA4C3B8B953E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD639D9E-2722-47EF-94F0-2CAF9E94EFD4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA9CA7B-AC2C-408A-B759-E2F4778B20ED",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "38A42369-3558-4015-AF7B-7F2E2465AE61",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E0D8DDC4-17FB-4A9D-BB01-E8C130B04ED2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B47572BC-93F8-4E53-B2B7-E00855B59499",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D80337C7-2A72-4E09-858B-0AA817D70746",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "670224DA-CE4B-46BE-8B5C-2F310F7988B4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59B86FAE-2D7E-4B30-835A-C3D37A361A29",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6DE3DC2D-7C6E-4044-AAB7-75FA5451AA56",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7940F80-A647-488F-95D7-FBBB46CD5100",
"versionEndIncluding": "8.7.0.0-2.3.0.8",
"versionStartIncluding": "8.7.0.0-2.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files in the underlying operating system.\n"
}
],
"id": "CVE-2023-22774",
"lastModified": "2024-11-21T07:45:24.070",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "security-alert@hpe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-03-01T08:15:14.253",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-03-01 08:15
Modified
2024-11-21 07:45
Severity ?
4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Summary
An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files on the underlying operating system, including sensitive system files.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "83AF7A4D-4169-47A8-A6BD-70C2AEB5E199",
"versionEndIncluding": "8.6.0.19",
"versionStartIncluding": "8.6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB80251-B38D-4145-89E8-FFBFB653D8A4",
"versionEndIncluding": "8.10.0.4",
"versionStartIncluding": "8.10.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E9226A2A-7048-4300-AC20-7629AA05E9D9",
"versionEndIncluding": "10.3.1.0",
"versionStartIncluding": "10.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA13FF5-7C60-48B4-AF46-18A9F19D5D42",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0B1EB3D9-77B5-4DBE-9518-23DD0DA06BC9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17162DB3-973E-47C6-9157-39A0E94603F2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-10:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F10CF160-4F83-452D-9BA5-E8DCA1A15ABB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E729365A-B367-474E-BD7D-8437AD47D9B1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-250:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5FDDD143-B396-4C58-9FB9-BA4C3B8B953E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD639D9E-2722-47EF-94F0-2CAF9E94EFD4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA9CA7B-AC2C-408A-B759-E2F4778B20ED",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "38A42369-3558-4015-AF7B-7F2E2465AE61",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E0D8DDC4-17FB-4A9D-BB01-E8C130B04ED2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B47572BC-93F8-4E53-B2B7-E00855B59499",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D80337C7-2A72-4E09-858B-0AA817D70746",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "670224DA-CE4B-46BE-8B5C-2F310F7988B4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59B86FAE-2D7E-4B30-835A-C3D37A361A29",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6DE3DC2D-7C6E-4044-AAB7-75FA5451AA56",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7940F80-A647-488F-95D7-FBBB46CD5100",
"versionEndIncluding": "8.7.0.0-2.3.0.8",
"versionStartIncluding": "8.7.0.0-2.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files on the underlying operating system, including sensitive system files.\n"
}
],
"id": "CVE-2023-22776",
"lastModified": "2024-11-21T07:45:24.307",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 3.6,
"source": "security-alert@hpe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-03-01T08:15:14.473",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-12-12 13:15
Modified
2024-11-21 07:15
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| arubanetworks | sd-wan | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | 10.3.0.0 | |
| arubanetworks | 7005 | - | |
| arubanetworks | 7008 | - | |
| arubanetworks | 7010 | - | |
| arubanetworks | 7024 | - | |
| arubanetworks | 7030 | - | |
| arubanetworks | 7205 | - | |
| arubanetworks | 7210 | - | |
| arubanetworks | 7220 | - | |
| arubanetworks | 7240xm | - | |
| arubanetworks | 7280 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0103D83D-C5A8-4F59-B5AF-B6F39A3F613F",
"versionEndExcluding": "8.7.0.0-2.3.0.7",
"versionStartIncluding": "8.7.0.0-2.3.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "174292ED-9C76-4815-8DBA-E83CB1A59E96",
"versionEndExcluding": "6.5.4.23",
"versionStartIncluding": "6.5.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "28D7A806-4AB8-49DD-91D0-E81E3B4FD468",
"versionEndExcluding": "8.6.0.18",
"versionStartIncluding": "8.4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F6E4F019-F048-4E6C-9EC7-B9B6A776C246",
"versionEndExcluding": "8.7.1.10",
"versionStartIncluding": "8.7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0AAF010C-30AB-43D2-BAAB-813B869675FB",
"versionEndIncluding": "8.9.0.3",
"versionStartIncluding": "8.8.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84A36EB0-A525-4B05-B9CE-A31145A7157C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7005:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FE128072-9444-40D5-AC86-BB317869EB97",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7008:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F747F71E-66BC-4776-BCCC-3123F8EEEBC6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "15FE873C-3C45-4EA3-9AD1-D07F132BC31F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. \n\n"
},
{
"lang": "es",
"value": "Existen vulnerabilidades de inyecci\u00f3n de comandos autenticadas en la interfaz de l\u00ednea de comandos de ArubaOS. La explotaci\u00f3n exitosa de estas vulnerabilidades da como resultado la capacidad de ejecutar comandos arbitrarios como usuario privilegiado en el sistema operativo subyacente."
}
],
"id": "CVE-2022-37901",
"lastModified": "2024-11-21T07:15:20.683",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "security-alert@hpe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-12-12T13:15:12.737",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-09-07 13:15
Modified
2024-11-21 06:15
Severity ?
Summary
A local path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.0-2.2.0.4; Prior to 8.7.1.1, 8.6.0.7, 8.5.0.12, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security-alert@hpe.com | https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf | Patch, Third Party Advisory | |
| security-alert@hpe.com | https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| arubanetworks | sd-wan | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | 7005 | - | |
| arubanetworks | 7008 | - | |
| arubanetworks | 7010 | - | |
| arubanetworks | 7024 | - | |
| arubanetworks | 7030 | - | |
| arubanetworks | 7205 | - | |
| arubanetworks | 7210 | - | |
| arubanetworks | 7220 | - | |
| arubanetworks | 7240xm | - | |
| arubanetworks | 7280 | - | |
| arubanetworks | 9004 | - | |
| arubanetworks | 9004-lte | - | |
| arubanetworks | 9012 | - | |
| siemens | scalance_w1750d_firmware | * | |
| siemens | scalance_w1750d | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E4BAB5F6-D00B-49DA-A9C9-26D19168185B",
"versionEndExcluding": "2.2.0.4",
"versionStartIncluding": "2.2.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C7025607-CDA9-4A3A-BB64-93C2B5E77DBD",
"versionEndExcluding": "8.3.0.15",
"versionStartIncluding": "8.3.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "52A8E4BB-BCA7-4ADA-AB8C-261B35FFF83F",
"versionEndExcluding": "8.5.0.12",
"versionStartIncluding": "8.5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CCACC080-B78C-4DC7-8D92-333D7ACB30D7",
"versionEndExcluding": "8.6.0.8",
"versionStartIncluding": "8.6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "11CB4B7D-E78D-400F-B1B8-979D51776066",
"versionEndExcluding": "8.7.1.2",
"versionStartIncluding": "8.7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7005:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FE128072-9444-40D5-AC86-BB317869EB97",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7008:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F747F71E-66BC-4776-BCCC-3123F8EEEBC6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "15FE873C-3C45-4EA3-9AD1-D07F132BC31F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA13FF5-7C60-48B4-AF46-18A9F19D5D42",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0B1EB3D9-77B5-4DBE-9518-23DD0DA06BC9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17162DB3-973E-47C6-9157-39A0E94603F2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:scalance_w1750d_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B4603220-61F1-4686-B55D-F9F5D27F324A",
"versionEndExcluding": "8.7.1.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:scalance_w1750d:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FBC30055-239F-4BB1-B2D1-E5E35F0D8911",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A local path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.0-2.2.0.4; Prior to 8.7.1.1, 8.6.0.7, 8.5.0.12, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability."
},
{
"lang": "es",
"value": "Se ha detectado una vulnerabilidad de salto de ruta local en Aruba SD-WAN Software and Gateways; Aruba Operating System Software versiones: anteriores a 8.6.0.0-2.2.0.4; anteriores a 8.7.1.1, 8.6.0.7, 8.5.0.12, 8.3.0.16. Aruba ha publicado parches para Aruba SD-WAN Software and Gateways y ArubaOS que solucionan esta vulnerabilidad de seguridad"
}
],
"id": "CVE-2021-37731",
"lastModified": "2024-11-21T06:15:49.533",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 0.3,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-09-07T13:15:08.070",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf"
},
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-03-01 08:15
Modified
2024-11-21 07:45
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "83AF7A4D-4169-47A8-A6BD-70C2AEB5E199",
"versionEndIncluding": "8.6.0.19",
"versionStartIncluding": "8.6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB80251-B38D-4145-89E8-FFBFB653D8A4",
"versionEndIncluding": "8.10.0.4",
"versionStartIncluding": "8.10.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E9226A2A-7048-4300-AC20-7629AA05E9D9",
"versionEndIncluding": "10.3.1.0",
"versionStartIncluding": "10.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA13FF5-7C60-48B4-AF46-18A9F19D5D42",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0B1EB3D9-77B5-4DBE-9518-23DD0DA06BC9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17162DB3-973E-47C6-9157-39A0E94603F2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-10:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F10CF160-4F83-452D-9BA5-E8DCA1A15ABB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E729365A-B367-474E-BD7D-8437AD47D9B1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-250:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5FDDD143-B396-4C58-9FB9-BA4C3B8B953E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD639D9E-2722-47EF-94F0-2CAF9E94EFD4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA9CA7B-AC2C-408A-B759-E2F4778B20ED",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "38A42369-3558-4015-AF7B-7F2E2465AE61",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E0D8DDC4-17FB-4A9D-BB01-E8C130B04ED2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B47572BC-93F8-4E53-B2B7-E00855B59499",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D80337C7-2A72-4E09-858B-0AA817D70746",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "670224DA-CE4B-46BE-8B5C-2F310F7988B4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59B86FAE-2D7E-4B30-835A-C3D37A361A29",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6DE3DC2D-7C6E-4044-AAB7-75FA5451AA56",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7940F80-A647-488F-95D7-FBBB46CD5100",
"versionEndIncluding": "8.7.0.0-2.3.0.8",
"versionStartIncluding": "8.7.0.0-2.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n"
}
],
"id": "CVE-2023-22768",
"lastModified": "2024-11-21T07:45:23.337",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "security-alert@hpe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-03-01T08:15:13.833",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-12-11 02:15
Modified
2024-11-21 05:15
Severity ?
Summary
An attacker is able to remotely inject arbitrary commands by sending especially crafted packets destined to the PAPI (Aruba Networks AP Management protocol) UDP port (8211) of access-pointsor controllers in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below ; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | 7005 | - | |
| arubanetworks | 7008 | - | |
| arubanetworks | 7010 | - | |
| arubanetworks | 7024 | - | |
| arubanetworks | 7030 | - | |
| arubanetworks | 7205 | - | |
| arubanetworks | 7210 | - | |
| arubanetworks | 7220 | - | |
| arubanetworks | 7240xm | - | |
| arubanetworks | 7280 | - | |
| arubanetworks | sd-wan | * | |
| arubanetworks | sd-wan | * | |
| arubanetworks | 9004 | - | |
| arubanetworks | 9004-lte | - | |
| arubanetworks | 9012 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "49A45927-D609-48E3-A5E5-FEB977F4F58D",
"versionEndExcluding": "8.2.2.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D3E3ED71-0BA0-4D76-9BB7-D84FA571C4D0",
"versionEndExcluding": "8.3.0.14",
"versionStartIncluding": "8.3.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "419BC61F-B002-4848-BB6B-51CA15C8E6F2",
"versionEndExcluding": "8.5.0.11",
"versionStartIncluding": "8.4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C6A4597E-0267-4DA8-BFFB-513BEA7D04D4",
"versionEndExcluding": "8.6.0.6",
"versionStartIncluding": "8.6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "894088FF-5838-4CE7-AA31-CE7FB247E271",
"versionEndExcluding": "8.7.1.0",
"versionStartIncluding": "8.7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7005:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FE128072-9444-40D5-AC86-BB317869EB97",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7008:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F747F71E-66BC-4776-BCCC-3123F8EEEBC6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "15FE873C-3C45-4EA3-9AD1-D07F132BC31F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A206DE28-E15A-437B-BC1C-261F32F24F3A",
"versionEndExcluding": "2.1.0.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A1D1957E-1DFE-495B-8DF5-C1640857DDF4",
"versionEndExcluding": "2.2.0.1",
"versionStartIncluding": "2.2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA13FF5-7C60-48B4-AF46-18A9F19D5D42",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0B1EB3D9-77B5-4DBE-9518-23DD0DA06BC9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17162DB3-973E-47C6-9157-39A0E94603F2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An attacker is able to remotely inject arbitrary commands by sending especially crafted packets destined to the PAPI (Aruba Networks AP Management protocol) UDP port (8211) of access-pointsor controllers in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below ; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below."
},
{
"lang": "es",
"value": "Un atacante es capaz de inyectar remotamente comandos arbitrarios mediante el env\u00edo de paquetes especialmente dise\u00f1ados destinados al puerto UDP (8211) de PAPI (protocolo de Aruba Networks AP Management) de puntos de acceso o controladores en Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers versiones: 2.1.0.1, 2.2.0.0 y por debajo; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 y por debajo; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 y por debajo"
}
],
"id": "CVE-2020-24634",
"lastModified": "2024-11-21T05:15:17.977",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-12-11T02:15:11.057",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbnw04072en_us"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbnw04072en_us"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-03-01 08:15
Modified
2024-11-21 07:45
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "83AF7A4D-4169-47A8-A6BD-70C2AEB5E199",
"versionEndIncluding": "8.6.0.19",
"versionStartIncluding": "8.6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB80251-B38D-4145-89E8-FFBFB653D8A4",
"versionEndIncluding": "8.10.0.4",
"versionStartIncluding": "8.10.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E9226A2A-7048-4300-AC20-7629AA05E9D9",
"versionEndIncluding": "10.3.1.0",
"versionStartIncluding": "10.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA13FF5-7C60-48B4-AF46-18A9F19D5D42",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0B1EB3D9-77B5-4DBE-9518-23DD0DA06BC9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17162DB3-973E-47C6-9157-39A0E94603F2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-10:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F10CF160-4F83-452D-9BA5-E8DCA1A15ABB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E729365A-B367-474E-BD7D-8437AD47D9B1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-250:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5FDDD143-B396-4C58-9FB9-BA4C3B8B953E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD639D9E-2722-47EF-94F0-2CAF9E94EFD4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA9CA7B-AC2C-408A-B759-E2F4778B20ED",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "38A42369-3558-4015-AF7B-7F2E2465AE61",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E0D8DDC4-17FB-4A9D-BB01-E8C130B04ED2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B47572BC-93F8-4E53-B2B7-E00855B59499",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D80337C7-2A72-4E09-858B-0AA817D70746",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "670224DA-CE4B-46BE-8B5C-2F310F7988B4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59B86FAE-2D7E-4B30-835A-C3D37A361A29",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6DE3DC2D-7C6E-4044-AAB7-75FA5451AA56",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7940F80-A647-488F-95D7-FBBB46CD5100",
"versionEndIncluding": "8.7.0.0-2.3.0.8",
"versionStartIncluding": "8.7.0.0-2.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n"
}
],
"id": "CVE-2023-22769",
"lastModified": "2024-11-21T07:45:23.453",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "security-alert@hpe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-03-01T08:15:13.900",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-03-01 08:15
Modified
2024-11-21 07:45
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "83AF7A4D-4169-47A8-A6BD-70C2AEB5E199",
"versionEndIncluding": "8.6.0.19",
"versionStartIncluding": "8.6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB80251-B38D-4145-89E8-FFBFB653D8A4",
"versionEndIncluding": "8.10.0.4",
"versionStartIncluding": "8.10.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E9226A2A-7048-4300-AC20-7629AA05E9D9",
"versionEndIncluding": "10.3.1.0",
"versionStartIncluding": "10.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA13FF5-7C60-48B4-AF46-18A9F19D5D42",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0B1EB3D9-77B5-4DBE-9518-23DD0DA06BC9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17162DB3-973E-47C6-9157-39A0E94603F2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-10:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F10CF160-4F83-452D-9BA5-E8DCA1A15ABB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E729365A-B367-474E-BD7D-8437AD47D9B1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-250:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5FDDD143-B396-4C58-9FB9-BA4C3B8B953E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD639D9E-2722-47EF-94F0-2CAF9E94EFD4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA9CA7B-AC2C-408A-B759-E2F4778B20ED",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "38A42369-3558-4015-AF7B-7F2E2465AE61",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E0D8DDC4-17FB-4A9D-BB01-E8C130B04ED2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B47572BC-93F8-4E53-B2B7-E00855B59499",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D80337C7-2A72-4E09-858B-0AA817D70746",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "670224DA-CE4B-46BE-8B5C-2F310F7988B4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59B86FAE-2D7E-4B30-835A-C3D37A361A29",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6DE3DC2D-7C6E-4044-AAB7-75FA5451AA56",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7940F80-A647-488F-95D7-FBBB46CD5100",
"versionEndIncluding": "8.7.0.0-2.3.0.8",
"versionStartIncluding": "8.7.0.0-2.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n"
}
],
"id": "CVE-2023-22767",
"lastModified": "2024-11-21T07:45:23.220",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "security-alert@hpe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-03-01T08:15:13.767",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-12-12 13:15
Modified
2024-11-21 07:15
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
A vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled content via the web interface. Successful exploitation of this vulnerability could lead to full compromise the underlying host operating system.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| arubanetworks | sd-wan | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | 10.3.0.0 | |
| arubanetworks | 7005 | - | |
| arubanetworks | 7008 | - | |
| arubanetworks | 7010 | - | |
| arubanetworks | 7024 | - | |
| arubanetworks | 7030 | - | |
| arubanetworks | 7205 | - | |
| arubanetworks | 7210 | - | |
| arubanetworks | 7220 | - | |
| arubanetworks | 7240xm | - | |
| arubanetworks | 7280 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0103D83D-C5A8-4F59-B5AF-B6F39A3F613F",
"versionEndExcluding": "8.7.0.0-2.3.0.7",
"versionStartIncluding": "8.7.0.0-2.3.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "174292ED-9C76-4815-8DBA-E83CB1A59E96",
"versionEndExcluding": "6.5.4.23",
"versionStartIncluding": "6.5.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "28D7A806-4AB8-49DD-91D0-E81E3B4FD468",
"versionEndExcluding": "8.6.0.18",
"versionStartIncluding": "8.4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F6E4F019-F048-4E6C-9EC7-B9B6A776C246",
"versionEndExcluding": "8.7.1.10",
"versionStartIncluding": "8.7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0AAF010C-30AB-43D2-BAAB-813B869675FB",
"versionEndIncluding": "8.9.0.3",
"versionStartIncluding": "8.8.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84A36EB0-A525-4B05-B9CE-A31145A7157C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7005:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FE128072-9444-40D5-AC86-BB317869EB97",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7008:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F747F71E-66BC-4776-BCCC-3123F8EEEBC6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "15FE873C-3C45-4EA3-9AD1-D07F132BC31F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled content via the web interface. Successful exploitation of this vulnerability could lead to full compromise the underlying host operating system.\n\n"
},
{
"lang": "es",
"value": "Existe una vulnerabilidad que permite a un atacante autenticado sobrescribir un archivo arbitrario con contenido controlado por el atacante a trav\u00e9s de la interfaz web. La explotaci\u00f3n exitosa de esta vulnerabilidad podr\u00eda comprometer completamente el sistema operativo del host subyacente."
}
],
"id": "CVE-2022-37903",
"lastModified": "2024-11-21T07:15:20.970",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "security-alert@hpe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-12-12T13:15:12.863",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-03-01 08:15
Modified
2024-11-21 07:45
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "83AF7A4D-4169-47A8-A6BD-70C2AEB5E199",
"versionEndIncluding": "8.6.0.19",
"versionStartIncluding": "8.6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB80251-B38D-4145-89E8-FFBFB653D8A4",
"versionEndIncluding": "8.10.0.4",
"versionStartIncluding": "8.10.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E9226A2A-7048-4300-AC20-7629AA05E9D9",
"versionEndIncluding": "10.3.1.0",
"versionStartIncluding": "10.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA13FF5-7C60-48B4-AF46-18A9F19D5D42",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0B1EB3D9-77B5-4DBE-9518-23DD0DA06BC9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17162DB3-973E-47C6-9157-39A0E94603F2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-10:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F10CF160-4F83-452D-9BA5-E8DCA1A15ABB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E729365A-B367-474E-BD7D-8437AD47D9B1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-250:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5FDDD143-B396-4C58-9FB9-BA4C3B8B953E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD639D9E-2722-47EF-94F0-2CAF9E94EFD4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA9CA7B-AC2C-408A-B759-E2F4778B20ED",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "38A42369-3558-4015-AF7B-7F2E2465AE61",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E0D8DDC4-17FB-4A9D-BB01-E8C130B04ED2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B47572BC-93F8-4E53-B2B7-E00855B59499",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D80337C7-2A72-4E09-858B-0AA817D70746",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "670224DA-CE4B-46BE-8B5C-2F310F7988B4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59B86FAE-2D7E-4B30-835A-C3D37A361A29",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6DE3DC2D-7C6E-4044-AAB7-75FA5451AA56",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7940F80-A647-488F-95D7-FBBB46CD5100",
"versionEndIncluding": "8.7.0.0-2.3.0.8",
"versionStartIncluding": "8.7.0.0-2.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n"
}
],
"id": "CVE-2023-22770",
"lastModified": "2024-11-21T07:45:23.573",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "security-alert@hpe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-03-01T08:15:13.963",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-03-01 08:15
Modified
2024-11-21 07:45
Severity ?
6.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
2.4 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
2.4 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Summary
An insufficient session expiration vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability allows an attacker to keep a session running on an affected device after the removal of the impacted account
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "83AF7A4D-4169-47A8-A6BD-70C2AEB5E199",
"versionEndIncluding": "8.6.0.19",
"versionStartIncluding": "8.6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB80251-B38D-4145-89E8-FFBFB653D8A4",
"versionEndIncluding": "8.10.0.4",
"versionStartIncluding": "8.10.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E9226A2A-7048-4300-AC20-7629AA05E9D9",
"versionEndIncluding": "10.3.1.0",
"versionStartIncluding": "10.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA13FF5-7C60-48B4-AF46-18A9F19D5D42",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0B1EB3D9-77B5-4DBE-9518-23DD0DA06BC9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17162DB3-973E-47C6-9157-39A0E94603F2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-10:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F10CF160-4F83-452D-9BA5-E8DCA1A15ABB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E729365A-B367-474E-BD7D-8437AD47D9B1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-250:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5FDDD143-B396-4C58-9FB9-BA4C3B8B953E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD639D9E-2722-47EF-94F0-2CAF9E94EFD4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA9CA7B-AC2C-408A-B759-E2F4778B20ED",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "38A42369-3558-4015-AF7B-7F2E2465AE61",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E0D8DDC4-17FB-4A9D-BB01-E8C130B04ED2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B47572BC-93F8-4E53-B2B7-E00855B59499",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D80337C7-2A72-4E09-858B-0AA817D70746",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "670224DA-CE4B-46BE-8B5C-2F310F7988B4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59B86FAE-2D7E-4B30-835A-C3D37A361A29",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6DE3DC2D-7C6E-4044-AAB7-75FA5451AA56",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7940F80-A647-488F-95D7-FBBB46CD5100",
"versionEndIncluding": "8.7.0.0-2.3.0.8",
"versionStartIncluding": "8.7.0.0-2.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An insufficient session expiration vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability allows an attacker to keep a session running on an affected device after the removal of the impacted account\n\n"
}
],
"id": "CVE-2023-22771",
"lastModified": "2024-11-21T07:45:23.693",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 0.9,
"impactScore": 5.9,
"source": "security-alert@hpe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.4,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 0.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-03-01T08:15:14.030",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-613"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-12-12 13:15
Modified
2024-11-21 07:15
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| arubanetworks | sd-wan | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | 10.3.0.0 | |
| arubanetworks | 7005 | - | |
| arubanetworks | 7008 | - | |
| arubanetworks | 7010 | - | |
| arubanetworks | 7024 | - | |
| arubanetworks | 7030 | - | |
| arubanetworks | 7205 | - | |
| arubanetworks | 7210 | - | |
| arubanetworks | 7220 | - | |
| arubanetworks | 7240xm | - | |
| arubanetworks | 7280 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0103D83D-C5A8-4F59-B5AF-B6F39A3F613F",
"versionEndExcluding": "8.7.0.0-2.3.0.7",
"versionStartIncluding": "8.7.0.0-2.3.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "174292ED-9C76-4815-8DBA-E83CB1A59E96",
"versionEndExcluding": "6.5.4.23",
"versionStartIncluding": "6.5.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "28D7A806-4AB8-49DD-91D0-E81E3B4FD468",
"versionEndExcluding": "8.6.0.18",
"versionStartIncluding": "8.4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F6E4F019-F048-4E6C-9EC7-B9B6A776C246",
"versionEndExcluding": "8.7.1.10",
"versionStartIncluding": "8.7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0AAF010C-30AB-43D2-BAAB-813B869675FB",
"versionEndIncluding": "8.9.0.3",
"versionStartIncluding": "8.8.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84A36EB0-A525-4B05-B9CE-A31145A7157C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7005:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FE128072-9444-40D5-AC86-BB317869EB97",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7008:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F747F71E-66BC-4776-BCCC-3123F8EEEBC6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "15FE873C-3C45-4EA3-9AD1-D07F132BC31F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. \n\n"
},
{
"lang": "es",
"value": "Existen vulnerabilidades de inyecci\u00f3n de comandos autenticadas en la interfaz de l\u00ednea de comandos de ArubaOS. La explotaci\u00f3n exitosa de estas vulnerabilidades da como resultado la capacidad de ejecutar comandos arbitrarios como usuario privilegiado en el sistema operativo subyacente."
}
],
"id": "CVE-2022-37900",
"lastModified": "2024-11-21T07:15:20.537",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "security-alert@hpe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-12-12T13:15:12.677",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-12-12 13:15
Modified
2024-11-21 07:15
Severity ?
5.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Summary
An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exploitation can compromise the hardware chain of trust on the impacted controller.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| arubanetworks | sd-wan | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | 7005 | - | |
| arubanetworks | 7008 | - | |
| arubanetworks | 7010 | - | |
| arubanetworks | 7024 | - | |
| arubanetworks | 7030 | - | |
| arubanetworks | 7205 | - | |
| arubanetworks | 7210 | - | |
| arubanetworks | 7220 | - | |
| arubanetworks | 7240xm | - | |
| arubanetworks | 7280 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4CF50C4E-038A-4120-BF86-05DF607C59CB",
"versionEndExcluding": "8.7.0.0-2.3.0.6",
"versionStartIncluding": "8.7.0.0-2.3.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "49CE5580-518E-4CC8-894A-A78F476D6EC7",
"versionEndExcluding": "6.5.4.22",
"versionStartIncluding": "6.5.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "58A7807B-5AD1-4CE1-8974-772067778D97",
"versionEndExcluding": "8.6.0.17",
"versionStartIncluding": "8.4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F077A2FC-EE0D-4D8F-A5E1-A1BE3285EFDD",
"versionEndExcluding": "8.7.1.9",
"versionStartIncluding": "8.7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8E3B42F6-8255-411C-8E0D-9992F3C5F633",
"versionEndExcluding": "10.3.0.1",
"versionStartIncluding": "8.8.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7005:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FE128072-9444-40D5-AC86-BB317869EB97",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7008:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F747F71E-66BC-4776-BCCC-3123F8EEEBC6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "15FE873C-3C45-4EA3-9AD1-D07F132BC31F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exploitation can compromise the hardware chain of trust on the impacted controller.\n\n"
},
{
"lang": "es",
"value": "Un atacante autenticado puede afectar la integridad del gestor de arranque de ArubaOS en los controladores de la serie 7xxx. Una explotaci\u00f3n exitosa puede comprometer la cadena de confianza del hardware en el controlador afectado."
}
],
"id": "CVE-2022-37908",
"lastModified": "2024-11-21T07:15:21.647",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.3,
"impactScore": 4.0,
"source": "security-alert@hpe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-12-12T13:15:13.187",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-12-11 02:15
Modified
2024-11-21 05:15
Severity ?
Summary
There are multiple buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending especially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211) of access-points or controllers in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | 7005 | - | |
| arubanetworks | 7008 | - | |
| arubanetworks | 7010 | - | |
| arubanetworks | 7024 | - | |
| arubanetworks | 7030 | - | |
| arubanetworks | 7205 | - | |
| arubanetworks | 7210 | - | |
| arubanetworks | 7220 | - | |
| arubanetworks | 7240xm | - | |
| arubanetworks | 7280 | - | |
| arubanetworks | sd-wan | * | |
| arubanetworks | sd-wan | * | |
| arubanetworks | 9004 | - | |
| arubanetworks | 9004-lte | - | |
| arubanetworks | 9012 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DE1BBC46-36EA-47DE-9173-707A23325F1A",
"versionEndExcluding": "6.4.4.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "66C41F7C-BB41-449A-B030-C029E33AD041",
"versionEndExcluding": "6.5.4.18",
"versionStartIncluding": "6.5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "65383999-0515-4646-9510-677D33ECBB11",
"versionEndExcluding": "8.2.2.10",
"versionStartIncluding": "8.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D3E3ED71-0BA0-4D76-9BB7-D84FA571C4D0",
"versionEndExcluding": "8.3.0.14",
"versionStartIncluding": "8.3.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "419BC61F-B002-4848-BB6B-51CA15C8E6F2",
"versionEndExcluding": "8.5.0.11",
"versionStartIncluding": "8.4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C6A4597E-0267-4DA8-BFFB-513BEA7D04D4",
"versionEndExcluding": "8.6.0.6",
"versionStartIncluding": "8.6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "894088FF-5838-4CE7-AA31-CE7FB247E271",
"versionEndExcluding": "8.7.1.0",
"versionStartIncluding": "8.7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7005:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FE128072-9444-40D5-AC86-BB317869EB97",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7008:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F747F71E-66BC-4776-BCCC-3123F8EEEBC6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "15FE873C-3C45-4EA3-9AD1-D07F132BC31F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A206DE28-E15A-437B-BC1C-261F32F24F3A",
"versionEndExcluding": "2.1.0.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A1D1957E-1DFE-495B-8DF5-C1640857DDF4",
"versionEndExcluding": "2.2.0.1",
"versionStartIncluding": "2.2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA13FF5-7C60-48B4-AF46-18A9F19D5D42",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0B1EB3D9-77B5-4DBE-9518-23DD0DA06BC9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17162DB3-973E-47C6-9157-39A0E94603F2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "There are multiple buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending especially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211) of access-points or controllers in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below."
},
{
"lang": "es",
"value": "Se presentan m\u00faltiples vulnerabilidades de desbordamiento de b\u00fafer que podr\u00edan conllevar a una ejecuci\u00f3n de c\u00f3digo remota no autenticada mediante el env\u00edo de paquetes especialmente dise\u00f1ados destinados al puerto UDP (8211) de PAPI (protocolo de administraci\u00f3n Aruba Networks AP) de puntos de acceso o controladores en Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers versiones: 2.1.0.1, 2.2.0.0 y por debajo; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 y por debajo; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 y por debajo"
}
],
"id": "CVE-2020-24633",
"lastModified": "2024-11-21T05:15:17.810",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-12-11T02:15:10.943",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbnw04072en_us"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbnw04072en_us"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-12-12 13:15
Modified
2024-11-21 07:15
Severity ?
6.6 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| arubanetworks | sd-wan | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | * | |
| arubanetworks | arubaos | 10.3.0.0 | |
| arubanetworks | 7005 | - | |
| arubanetworks | 7008 | - | |
| arubanetworks | 7010 | - | |
| arubanetworks | 7024 | - | |
| arubanetworks | 7030 | - | |
| arubanetworks | 7205 | - | |
| arubanetworks | 7210 | - | |
| arubanetworks | 7220 | - | |
| arubanetworks | 7240xm | - | |
| arubanetworks | 7280 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4CF50C4E-038A-4120-BF86-05DF607C59CB",
"versionEndExcluding": "8.7.0.0-2.3.0.6",
"versionStartIncluding": "8.7.0.0-2.3.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "49CE5580-518E-4CC8-894A-A78F476D6EC7",
"versionEndExcluding": "6.5.4.22",
"versionStartIncluding": "6.5.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "58A7807B-5AD1-4CE1-8974-772067778D97",
"versionEndExcluding": "8.6.0.17",
"versionStartIncluding": "8.4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F077A2FC-EE0D-4D8F-A5E1-A1BE3285EFDD",
"versionEndExcluding": "8.7.1.9",
"versionStartIncluding": "8.7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "16FA1F06-8C2E-4DB6-AE03-48B49ABD967E",
"versionEndIncluding": "8.9.03",
"versionStartIncluding": "8.8.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84A36EB0-A525-4B05-B9CE-A31145A7157C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7005:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FE128072-9444-40D5-AC86-BB317869EB97",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7008:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F747F71E-66BC-4776-BCCC-3123F8EEEBC6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "15FE873C-3C45-4EA3-9AD1-D07F132BC31F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.\n\n"
},
{
"lang": "es",
"value": "Existen vulnerabilidades en ArubaOS que se ejecutan en controladores de la serie 7xxx que permiten a un atacante ejecutar c\u00f3digo arbitrario durante la secuencia de inicio. La explotaci\u00f3n exitosa podr\u00eda permitir a un atacante lograr una modificaci\u00f3n permanente del sistema operativo subyacente."
}
],
"id": "CVE-2022-37904",
"lastModified": "2024-11-21T07:15:21.130",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 0.7,
"impactScore": 5.9,
"source": "security-alert@hpe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-12-12T13:15:12.923",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-03-01 08:15
Modified
2024-11-21 07:45
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "83AF7A4D-4169-47A8-A6BD-70C2AEB5E199",
"versionEndIncluding": "8.6.0.19",
"versionStartIncluding": "8.6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB80251-B38D-4145-89E8-FFBFB653D8A4",
"versionEndIncluding": "8.10.0.4",
"versionStartIncluding": "8.10.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E9226A2A-7048-4300-AC20-7629AA05E9D9",
"versionEndIncluding": "10.3.1.0",
"versionStartIncluding": "10.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA13FF5-7C60-48B4-AF46-18A9F19D5D42",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0B1EB3D9-77B5-4DBE-9518-23DD0DA06BC9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17162DB3-973E-47C6-9157-39A0E94603F2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-10:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F10CF160-4F83-452D-9BA5-E8DCA1A15ABB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E729365A-B367-474E-BD7D-8437AD47D9B1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-250:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5FDDD143-B396-4C58-9FB9-BA4C3B8B953E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mc-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD639D9E-2722-47EF-94F0-2CAF9E94EFD4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA9CA7B-AC2C-408A-B759-E2F4778B20ED",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "38A42369-3558-4015-AF7B-7F2E2465AE61",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-hw-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E0D8DDC4-17FB-4A9D-BB01-E8C130B04ED2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-10k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B47572BC-93F8-4E53-B2B7-E00855B59499",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-1k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D80337C7-2A72-4E09-858B-0AA817D70746",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "670224DA-CE4B-46BE-8B5C-2F310F7988B4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59B86FAE-2D7E-4B30-835A-C3D37A361A29",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arubanetworks:mcr-va-5k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6DE3DC2D-7C6E-4044-AAB7-75FA5451AA56",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7940F80-A647-488F-95D7-FBBB46CD5100",
"versionEndIncluding": "8.7.0.0-2.3.0.8",
"versionStartIncluding": "8.7.0.0-2.3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n"
}
],
"id": "CVE-2023-22766",
"lastModified": "2024-11-21T07:45:23.100",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "security-alert@hpe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-03-01T08:15:13.700",
"references": [
{
"source": "security-alert@hpe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt"
}
],
"sourceIdentifier": "security-alert@hpe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}