CVE-2023-39266
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A vulnerability in the ArubaOS-Switch web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface provided certain configuration options are present. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
Risk Assessment
The risk to the organization involves the potential for malicious code execution in users' browsers, which could lead to data theft or session hijacking. An attacker could exploit this vulnerability to manipulate user data.
Recommendation
It is recommended to update the ArubaOS-Switch software to the latest version to mitigate this vulnerability. Additionally, reviewing the management interface configuration to minimize risk is advisable.
Other vulnerabilities in ArubaOS-Switch
See all- CVE-2023-39268Medium
CVE-2023-39268 in ArubaOS-Switch is a memory corruption vulnerability that could lead to unauthenticated remote code execution by receiving specially crafted packets. Successful exploitation allows arbitrary code execution as a privileged user on the underlying operating system.
- CVE-2023-39267Medium
An authenticated remote code execution vulnerability exists in ArubaOS-Switch. Successful exploitation results in a Denial-of-Service (DoS) condition in the switch.
Original NVD description (English source)
A vulnerability in the ArubaOS-Switch web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface provided certain configuration options are present. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.