Medium severity · published May 10, 2019
CVE-2018-7064
A reflected cross-site scripting (XSS) vulnerability is present in an unauthenticated Aruba Instant web interface
6.1
CVSS
1.4%
EPSS
No
On KEV
Description
A reflected cross-site scripting (XSS) vulnerability is present in an unauthenticated Aruba Instant web interface. An attacker could use this vulnerability to trick an IAP administrator into clicking a link which could then take administrative actions on the Instant cluster, or expose the session cookie for an administrative session. Workaround: Administrators should make sure they log out of the Aruba Instant UI when not actively managing the system, and should use caution clicking links from external sources while logged into the IAP administrative interface. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.0
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Aruba Instant · Arubanetworks
4.0 before 4.2.4.12; 6.5.0 before 6.5.4.11; 8.3.0 before 8.3.0.6; 8.4.0 before 8.4.0.1 · source: NVD
SW
Scalance W1750d Firmware · Siemens
before 8.4.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-7064
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-7064
Third Party Advisory
http://www.securityfocus.com/bid/108374
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-549547.pdf
Vendor Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-001.txt
More from Aruba Instant
9.8
CVE-2021-37726
A remote buffer overflow vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 8.7.x.x: 8.7.0.0 through 8.7.1.2
9.8
CVE-2016-2031
Multiple vulnerabilities exists in Aruba Instate before 4.1.3.0 and 4.2.3.1 due to insufficient validation of user-supplied input and insufficient checking of parameters, which…
9.8
CVE-2018-7084
A command injection vulnerability is present that permits an unauthenticated user with access to the Aruba Instant web interface to execute arbitrary system commands within the…
7.5
CVE-2016-2032
A vulnerability exists in the Aruba AirWave Management Platform 8.x prior to 8.2 in the management interface of an underlying system component called RabbitMQ, which could let a…
7.5
CVE-2018-7083
If a process running within Aruba Instant crashes, it may leave behind a "core dump", which contains the memory contents of the process at the time it crashed