A command injection vulnerability is present that permits an unauthenticated user with access to the Aruba Instant web interface to execute arbitrary system commands within the underlying operating system. An attacker could use this ability to copy files, read configuration, write files, delete files, or reboot the device. Workaround: Block access to the Aruba Instant web interface from all untrusted users. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.1
References
Link | Resource |
---|---|
http://www.securityfocus.com/bid/108374 | Broken Link Third Party Advisory VDB Entry |
https://cert-portal.siemens.com/productcert/pdf/ssa-549547.pdf | Third Party Advisory |
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-001.txt | Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: hpe
Published: 2019-05-10T17:14:37
Updated: 2019-05-20T15:06:02
Reserved: 2018-02-15T00:00:00
Link: CVE-2018-7084
JSON object: View
NVD Information
Status : Analyzed
Published: 2019-05-10T18:29:03.133
Modified: 2023-03-20T18:11:53.287
Link: CVE-2018-7084
JSON object: View
Redhat Information
No data.
CWE