CVE-2023-22771: An insufficient session expiration vulnerability exists in the ArubaOS command line interface

Low severity · published Mar 1, 2023

CVE-2023-22771

An insufficient session expiration vulnerability exists in the ArubaOS command line interface

2.4

CVSS

0.4%

EPSS

On KEV

Description

An insufficient session expiration vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability allows an attacker to keep a session running on an affected device after the removal of the impacted account

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

High

User interaction

Required

Confidentiality

None

Integrity

Low

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 38% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Arubaos · Arubanetworks

8.6.0.0 through 8.6.0.19; 8.10.0.0 through 8.10.0.4; 10.3.0.0 through 10.3.1.0 · source: NVD

Sd-wan · Arubanetworks

8.7.0.0-2.3.0.0 through 8.7.0.0-2.3.0.8 · source: NVD

Affected product

Arubaos

Arubanetworks

All Arubaos CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-22771

CVE.org

https://www.cve.org/CVERecord?id=CVE-2023-22771

Vendor Advisory

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt