CVE-2022-37917 — Improper Access Control in Airwave

CWE-284 — Improper Access Control3 documents3 sources
Severity
8.1HIGHNVD
EPSS
0.2%
top 62.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Arubanetworks Airwave
Timeline
PublishedDec 8

Description

Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive information and/or change network configurations with privileges at a higher effective level in Aruba AirWave Management Platform version(s): 8.2.15.0 and below.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 2.8 | Impact: 5.2

Affected Packages1 packages

▶NVDarubanetworks/airwave8.2.15.0

🔴Vulnerability Details

2
GHSA
GHSA-m4vp-q257-m88x: Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls↗2022-12-08
▶
CVEList
Broken Access Control for some Web-based Management URLs in AirWave Management Platform↗2022-12-08
▶
CVE-2022-37917 — Improper Access Control in Airwave | cvebase