CVE-2023-35978
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A vulnerability in ArubaOS allows an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
Risk Assessment
The risk to the organization involves the potential for malicious code execution in users' browsers, which could lead to data theft or session hijacking.
Recommendation
It is recommended to update ArubaOS to the latest version to mitigate this vulnerability and implement additional security measures such as input validation.
Original NVD description (English source)
A vulnerability in ArubaOS could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.