Log in Start free

Vulnerability · Published Dec 8, 2022 · Assigned by hpe

CVE-2022-37918Broken Access Control for some Web-based Management URLs in AirWave Management Platform

High 8.1

In plain English

A high-severity improper access control in Aruba AirWave Management Platform. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.8%top 42.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive information and/or change network configurations with privileges at a higher effective level in Aruba AirWave Management Platform version(s): 8.2.15.0 and below.

Affected products (as reported)

VendorProductVersions
n/a Aruba AirWave Management Platform 8.2.15.0 and below

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References