Lucene search

HpeCVE-2023-35971

HistoryJul 05, 2023 - 3:15 p.m.

CVE-2023-35971

2023-07-0515:15:09

CWE-79

hpe

web.nvd.nist.gov

arubaos

vulnerability

web-based management

remote attackers

stored xss

nvd

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS

0.001

Percentile

39.3%

JSON

A vulnerability in the ArubaOS web-based management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the affected interface.

Affected configurations

Nvd

Node

arubanetworksmc-va-10Match-

arubanetworksmc-va-1kMatch-

arubanetworksmc-va-250Match-

arubanetworksmc-va-50Match-

arubanetworksmcr-va-10kMatch-

arubanetworksmcr-va-1kMatch-

arubanetworksmcr-va-50Match-

arubanetworksmcr-va-500Match-

arubanetworksmcr-va-5kMatch-

arubanetworkssd-wanMatch-

arubanetworksmcr-hw-10kMatch-

arubanetworksmcr-hw-1kMatch-

arubanetworksmcr-hw-5kMatch-

AND

arubanetworksarubaosRange6.5.4.0–8.6.0.21

arubanetworksarubaosRange8.7.0.0–8.10.0.7

arubanetworksarubaosRange8.11.0.0–8.11.1.1

arubanetworksarubaosRange10.4.0.0–10.4.0.2

VendorProductVersionCPE
arubanetworksmc-va-10-cpe:2.3:a:arubanetworks:mc-va-10:-:*:*:*:*:*:*:*
arubanetworksmc-va-1k-cpe:2.3:a:arubanetworks:mc-va-1k:-:*:*:*:*:*:*:*
arubanetworksmc-va-250-cpe:2.3:a:arubanetworks:mc-va-250:-:*:*:*:*:*:*:*
arubanetworksmc-va-50-cpe:2.3:a:arubanetworks:mc-va-50:-:*:*:*:*:*:*:*
arubanetworksmcr-va-10k-cpe:2.3:a:arubanetworks:mcr-va-10k:-:*:*:*:*:*:*:*
arubanetworksmcr-va-1k-cpe:2.3:a:arubanetworks:mcr-va-1k:-:*:*:*:*:*:*:*
arubanetworksmcr-va-50-cpe:2.3:a:arubanetworks:mcr-va-50:-:*:*:*:*:*:*:*
arubanetworksmcr-va-500-cpe:2.3:a:arubanetworks:mcr-va-500:-:*:*:*:*:*:*:*
arubanetworksmcr-va-5k-cpe:2.3:a:arubanetworks:mcr-va-5k:-:*:*:*:*:*:*:*
arubanetworkssd-wan-cpe:2.3:a:arubanetworks:sd-wan:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
arubanetworks	mc-va-10	-	cpe:2.3:a:arubanetworks:mc-va-10:-:::::::*
arubanetworks	mc-va-1k	-	cpe:2.3:a:arubanetworks:mc-va-1k:-:::::::*
arubanetworks	mc-va-250	-	cpe:2.3:a:arubanetworks:mc-va-250:-:::::::*
arubanetworks	mc-va-50	-	cpe:2.3:a:arubanetworks:mc-va-50:-:::::::*
arubanetworks	mcr-va-10k	-	cpe:2.3:a:arubanetworks:mcr-va-10k:-:::::::*
arubanetworks	mcr-va-1k	-	cpe:2.3:a:arubanetworks:mcr-va-1k:-:::::::*
arubanetworks	mcr-va-50	-	cpe:2.3:a:arubanetworks:mcr-va-50:-:::::::*
arubanetworks	mcr-va-500	-	cpe:2.3:a:arubanetworks:mcr-va-500:-:::::::*
arubanetworks	mcr-va-5k	-	cpe:2.3:a:arubanetworks:mcr-va-5k:-:::::::*
arubanetworks	sd-wan	-	cpe:2.3:a:arubanetworks:sd-wan:-:::::::*

Rows per page:

1-10 of 141

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
    "vendor": "Hewlett Packard Enterprise (HPE)",
    "versions": [
      {
        "status": "affected",
        "version": "- ArubaOS 10.4.x.x:       10.4.0.1 and below"
      },
      {
        "status": "affected",
        "version": "- ArubaOS 8.11.x.x:       8.11.1.0 and below"
      },
      {
        "status": "affected",
        "version": "- ArubaOS 8.10.x.x:       8.10.0.6 and below"
      },
      {
        "status": "affected",
        "version": "- ArubaOS 8.6.x.x:         8.6.0.20 and below"
      }
    ]
  }
]

References

www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS

0.001

Percentile

39.3%

JSON

Related for CVE-2023-35971