Medium severity · published Oct 17, 2023
CVE-2023-4896
A vulnerability exists which allows an authenticated attacker to access sensitive information on the AirWave Management Platform web-based management interface
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability exists which allows an authenticated attacker to access sensitive information on the AirWave Management Platform web-based management interface. Successful exploitation allows the attacker to gain access to some data that could be further exploited to laterally access devices managed and monitored by the AirWave server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Airwave · Arubanetworks
through 8.2.15.2; 8.3.0 before 8.3.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4896
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4896
Vendor Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-015.txt
More from Airwave
9.8
CVE-2016-2031
Multiple vulnerabilities exists in Aruba Instate before 4.1.3.0 and 4.2.3.1 due to insufficient validation of user-supplied input and insufficient checking of parameters, which…
8.8
CVE-2021-25167
A remote unauthorized access vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1
8.8
CVE-2021-25166
A remote unauthorized access vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1
8.8
CVE-2021-25151
A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1
8.8
CVE-2021-26961
A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0