CVE-2023-22790
Assigner: hpe
Published: 2023-05-08T14:08:43.190Z
State: PUBLISHED
affected: defaultStatus: affected
product: Aruba Access Points running InstantOS and ArubaOS 10
vendor: Hewlett Packard Enterprise (HPE)
versions: status: affected
version: Aruba InstantOS 6.4.x:  6.4.4.8-4.2.4.20 and below
status: affected
version: Aruba InstantOS 6.5.x:  6.5.4.23 and below
status: affected
version: Aruba InstantOS 8.6.x:  8.6.0.19 and below
status: affected
version: Aruba InstantOS 8.10.x: 8.10.0.4 and below
status: affected
version: ArubaOS 10.3.x:         10.3.1.0 and below
status: affected
version: See reference document for further details
credits: type: reporter
user: 00000000-0000-4000-9000-000000000000
value: Daniel Jensen (@dozernz)
datePublic: 2023-05-09T20:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: Multiple authenticated command injection vulnerabilities&nbsp;exist in the Aruba InstantOS and ArubaOS 10 command line&nbsp;interface. Successful exploitation of these vulnerabilities&nbsp;result in the ability to execute arbitrary commands as a&nbsp;privileged user on the underlying operating system.
value: Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: description: n/a
source: discovery: UNKNOWN
title: Authenticated Remote Command Execution in Aruba InstantOS or ArubaOS 10 Command Line Interface
x_generator: engine: Vulnogram 0.1.0-dev