Skip to content
OpenAdvisories
High · 8.8 CVE-2023-35971 EUVD-2023-39955GHSA-w8v4-5hx2-xq34

Unauthenticated Stored Cross-Site Scripting (XSS) in ArubaOS Web-based Management Interface

Published Jul 5, 2023 · Updated Oct 21, 2024 · Assigned by hpe

Vendor: Hewlett Packard Enterprise (HPE) Product: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central

Description

A vulnerability in the ArubaOS web-based management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

Affected products

VendorProductAffectedFixed
Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central - ArubaOS 10.4.x.x: 10.4.0.1 and below, - ArubaOS 8.11.x.x: 8.11.1.0 and below, - ArubaOS 8.10.x.x: 8.10.0.6 and below, - ArubaOS 8.6.x.x: 8.6.0.20 and below —

Advisories 1

References