Authenticated Broken Access Control (BAC) in REST API Configuration Service (Hewlett Packard Enterprise (HPE) HPE Aruba Networking AOS-CX)
En bref
- Source
- NVD
- EPSS
- EPSS 0.30 % · centile 23 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- hpe
- Statut NVD
- Analyzed
Description
A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation of this vulnerability could enable the attacker to disclose sensitive data.
Faiblesses (CWE)
- CWE-200 — Exposition d'informations sensibles à un acteur non autorisé
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | hpe |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · security-alert@hpe.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2025-198065
- GCVE · GCVE-0-2025-37160
Avis du CERT-FR
- CERTFR-2025-AVI-1021 — Multiples vulnérabilités dans les produits HPE Aruba Networking · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.10.0000 < 10.10.1170cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.13.0000 < 10.13.1101cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.14.0000 < 10.14.1060cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.15.0000 < 10.15.1030cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.16.0000 < 10.16.1001
Produits affectés
| Produit | Versions |
|---|---|
| Hewlett Packard Enterprise (HPE) · HPE Aruba Networking AOS-CX | affected 10.16.0000 ≤ 10.16.1000 ; affected 10.15.0000 ≤ 10.15.1020 ; affected 10.14.0000 ≤ 10.14.1050 ; affected 10.13.0000 ≤ 10.13.1090 ; affected 10.10.0000 ≤ 10.10.1160 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |