Vulnerability · Published Sep 6, 2022 · Assigned by hpe

CVE-2022-23678

Medium 5.9

In plain English

A medium-severity security flaw in Aruba Virtual Intranet Access (VIA). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS NVD)5.9Medium

Exploit odds (30 days)1.0%top 38.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability in the Aruba Virtual Intranet Access (VIA) client for Microsoft Windows operating system client communications that could allow for an attacker in a privileged network position to intercept sensitive information in Aruba Virtual Intranet Access (VIA) client for Microsoft Windows operating system versions: 4.3.0 build 2208101 and below. Aruba has released upgrades for Virtual Intranet Access (VIA) Client that address this security vulnerability.

Affected products (as reported)

Vendor	Product	Versions
n/a	Aruba Virtual Intranet Access (VIA)	Windows Client Only - All versions lower than VIA 4.3.0 build 2208101

References

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-011.txt x_refsource_MISC