CVE-2023-22765
Assigner: hpe
Published: 2023-02-28T16:47:35.008Z
State: PUBLISHED
affected: defaultStatus: affected
product: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central
vendor: Hewlett Packard Enterprise (HPE)
versions: status: affected
version: ArubaOS 8.6.x.x:  8.6.0.19 and below
status: affected
version: ArubaOS 8.10.x.x:   8.10.0.4 and below
status: affected
version: ArubaOS 10.3.x.x:  10.3.1.0 and below
status: affected
version: SD-WAN 8.7.0.0-2.3.0.x:  8.7.0.0-2.3.0.8 and below
credits: type: reporter
user: 00000000-0000-4000-9000-000000000000
value: Erik de Jong (bugcrowd.com/erikdejong)
datePublic: 2023-02-28T21:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.<br><br>
value: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
source: discovery: UNKNOWN
title: Authenticated Remote Command Execution in the ArubaOS Command Line Interface
x_generator: engine: Vulnogram 0.1.0-dev
problemTypes: descriptions: description: n/a
type: text