CVE-2022-37911

published 2022-12-12

CVE-2022-37911: Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS. A successful exploit could allow an…

Priority P4 26 medium 5.5 CVSS 3.1

AV N AC L PR H UI N S U C L I N A H

Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS. A successful exploit could allow an authenticated attacker to retrieve files from the local system or cause the application to consume system resources, resulting in a denial of service condition.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
arubanetworks	arubaos	>= 6.5.4.0 < 6.5.4.22	6.5.4.22
arubanetworks	arubaos	>= 8.4.0.0 < 8.6.0.17	8.6.0.17
arubanetworks	arubaos	>= 8.7.0.0 < 8.7.1.9	8.7.1.9
arubanetworks	arubaos	>= 8.8.0.0 < 10.3.0.1	10.3.0.1
arubanetworks	sd-wan	>= 8.7.0.0-2.3.0.0 < 8.7.0.0-2.3.0.6	8.7.0.0-2.3.0.6

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-611