CVE-2023-22776

Published: Mar 1, 2023Modified: Mar 7, 2025

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.2 / Impact: 3.6

Source: NVD

Description

An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files on the underlying operating system, including sensitive system files.

Affected (4)

Products: Arubanetworks: Arubaos, Sd Wan

Arubanetworks

2 products

Arubaos

Sd Wan

Configuration A

3 vulnerable · 22 platform

Vulnerable Software	Affected Versions
Arubanetworks Arubaos	From 10.3.0.0 to 10.3.1.0
Arubanetworks Arubaos	From 8.10.0.0 to 8.10.0.4
Arubanetworks Arubaos	From 8.6.0.0 to 8.6.0.19

Running on/with	Platform Versions
Arubanetworks 7010	All versions
Arubanetworks 7030	All versions
Arubanetworks 7205	All versions
Arubanetworks 7210	All versions
Arubanetworks 7220	All versions
Arubanetworks 7240xm	All versions
Arubanetworks 7280	All versions
Arubanetworks 9004	All versions
Arubanetworks 9004 Lte	All versions
Arubanetworks 9012	All versions
Arubanetworks Mc Va 10	All versions
Arubanetworks Mc Va 1k	All versions
Arubanetworks Mc Va 250	All versions
Arubanetworks Mc Va 50	All versions
Arubanetworks Mcr Hw 10k	All versions
Arubanetworks Mcr Hw 1k	All versions
Arubanetworks Mcr Hw 5k	All versions
Arubanetworks Mcr Va 10k	All versions
Arubanetworks Mcr Va 1k	All versions
Arubanetworks Mcr Va 50	All versions
Arubanetworks Mcr Va 500	All versions
Arubanetworks Mcr Va 5k	All versions

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Arubanetworks Sd Wan	From 8.7.0.0-2.3.0.0 to 8.7.0.0-2.3.0.8

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (2)

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt

Source: security-alert@hpe.com

Vendor Advisory

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.