Summary
Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Aruba Switch ausnutzen, um einen Cross-Site-Scripting-Angriff zu starten, einen Denial-of-Service-Zustand zu verursachen und beliebigen Code als privilegierter Benutzer auszuführen.
Product
Ein Switch ist ein aktives Netzwerkgerät, das Datenpakete auf dem Data Link Layer (Layer 2) des OSI-Modells weiterleitet.
Vulnerabilities 3
-
High 8.3
Unauthenticated Stored Cross-Site Scripting in ArubaOS-Switch
A vulnerability in the ArubaOS-Switch web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface provided certain configuration options are present. A successfu…
-
Medium 6.6
Authenticated Denial of Service Vulnerability in ArubaOS-Switch Command Line Interface
An authenticated remote code execution vulnerability exists in the command line interface in ArubaOS-Switch. Successful exploitation results in a Denial-of-Service (DoS) condition in the switch.
-
Medium 4.5
Memory Corruption Vulnerability in ArubaOS-Switch
A memory corruption vulnerability in ArubaOS-Switch could lead to unauthenticated remote code execution by receiving specially crafted packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user…
Revision history
-
#2
Neue Updates von HP aufgenommen
-
#1
Initiale Fassung
References
-
HPE SecurityBulletin
https://support.hpe.com/hpesc/public/docDisplay?docId=emr_na-hpesbnw04533en_us
-
Proof of Concept für CVE-2023-39266
https://cybir.com/2022/cve/layer7mattersatlayer2-coolhandluke/
-
HPE Aruba Networking Product Security Advisory vom 2023-08-29
https://www.arubanetworks.com/security-advisory/arubaos-switch-switches-multiple-vulnerabilities/