Authenticated Remote Path Traversal in ArubaOS Command Line Interface Allows for Arbitrary File Read (Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.71 % · percentile 54 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- hpe
- NVD status
- Modified
Description
An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files on the underlying operating system, including sensitive system files.
Weaknesses (CWE)
- CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | hpe |
| CVSS 3.1 | MEDIUM 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | NVD · security-alert@hpe.com (Secondary) |
| CVSS 3.1 | MEDIUM 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2023-26894
- GCVE · GCVE-0-2023-22776
CERT-FR advisories
- CERTFR-2023-AVI-0178 — Multiples vulnérabilités dans Aruba ArubaOS · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*≥ 8.6.0.0 ≤ 8.6.0.19cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*≥ 8.10.0.0 ≤ 8.10.0.4cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*≥ 10.3.0.0 ≤ 10.3.1.0cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*≥ 8.7.0.0-2.3.0.0 ≤ 8.7.0.0-2.3.0.8
Affected products
| Product | Versions |
|---|---|
| Hewlett Packard Enterprise (HPE) · Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central | affected ArubaOS 8.6.x.x: 8.6.0.19 and below ; affected ArubaOS 8.10.x.x: 8.10.0.4 and below ; affected ArubaOS 10.3.x.x: 10.3.1.0 and below ; affected SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |