← Back

CVE-2022-23679

nvd nist
Published: Sep 6, 2022Modified: Nov 21, 2024

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

AOS-CX lacks Anti-CSRF protections in place for state-changing operations. This can potentially be exploited by an attacker to execute commands in the context of another user in ArubaOS-CX Switches version(s): AOS-CX 10.10.xxxx: 10.10.0002 and below, AOS-CX 10.09.xxxx: 10.09.1020 and below, AOS-CX 10.08.xxxx: 10.08.1060 and below, AOS-CX 10.06.xxxx: 10.06.0200 and below. Aruba has released upgrades for ArubaOS-CX Switch Devices that address this security vulnerability.

Affected (4)

Arubanetworks
1 product
Aos Cx
Configuration A
1 platform
Running on/withPlatform Versions
Arubanetworks
Cx 10000
All versions
Configuration B
1 platform
Running on/withPlatform Versions
Arubanetworks
Cx 8325
All versions
Configuration C
1 platform
Running on/withPlatform Versions
Arubanetworks
Cx 8320
All versions
Configuration D
1 platform
Running on/withPlatform Versions
Arubanetworks
Cx 9300
All versions
Configuration E
1 platform
Running on/withPlatform Versions
Arubanetworks
Cx 8360
All versions
Configuration F
1 platform
Running on/withPlatform Versions
Arubanetworks
Cx 6400
All versions
Configuration G
1 platform
Running on/withPlatform Versions
Arubanetworks
Cx 6300
All versions
Configuration H
1 platform
Running on/withPlatform Versions
Arubanetworks
Cx 6200f
All versions
Configuration I
1 platform
Running on/withPlatform Versions
Arubanetworks
Cx 6100
All versions
Configuration J
1 platform
Running on/withPlatform Versions
Arubanetworks
Cx 6000
All versions
Configuration K
1 platform
Running on/withPlatform Versions
Arubanetworks
Cx 4100i
All versions
Configuration L
4 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Arubanetworks
Aos Cx
From 10.06.0000 to 10.06.0210
Aos Cx
From 10.08.0000 to 10.08.1070
Aos Cx
From 10.09.0000 to 10.09.1030
Aos Cx
From 10.10.0000 to 10.10.1000
Running on/withPlatform Versions
Arubanetworks
Cx 8400
All versions

Related CWEs

CWE-352
Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (2)

Source: security-alert@hpe.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.