CVE-2017-9000 Information
Share on:Description
ArubaOS all versions prior to 6.3.1.25 6.4 prior to 6.4.4.16 6.5.x prior to 6.5.1.9 6.5.2 6.5.3 prior to 6.5.3.3 6.5.4 prior to 6.5.4.2 8.x prior to 8.1.0.4 FIPS and non-FIPS versions of software are both affected equally is vulnerable to unauthenticated arbitrary file access. An unauthenticated user with network access to an Aruba mobility controller on TCP port 8080 or 8081 may be able to access arbitrary files stored on the mobility controller. Ports 8080 and 8081 are used for captive portal functionality and are listening by default on all IP interfaces of the mobility controller including captive portal interfaces. The attacker could access files which could contain passwords keys and other sensitive information that could lead to full system compromise.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reference
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-006.txt http://www.securitytracker.com/id/1039580
Attack Complexity
LOW
Privileges Required
NONE
User Interaction Required
NONE
Scope
NONE
Confidentiality Impact
UNCHANGED
Integrity Impact
HIGH
Availability Impact
HIGH
Base Score
HIGH
Base Severity
9.8