CVSS: 9.0EPSS: 0%CPEs: 6EXPL: 0CVE-2018-7082
https://notcve.org/view.php?id=CVE-2018-7082
A command injection vulnerability is present in Aruba Instant that permits an authenticated administrative user to execute arbitrary commands on the underlying operating system. A malicious administrator could use this ability to install backdoors or change system configuration in a way that would not be logged. Workaround: None. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.0 Una vulnerabilidad de inyección de comandos está presente en Aruba Instant que permite a un usuario administrativo autenticado realizar comandos arbitrarios en el sistema operativo subyacente. Un administrador malicioso podría usar esta habilidad para instalar backdoors o cambiar la configuración del sistema de una manera que no quede registro. • http://www.securityfocus.com/bid/108374 https://cert-portal.siemens.com/productcert/pdf/ssa-549547.pdf https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-001.txt • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-7083
https://notcve.org/view.php?id=CVE-2018-7083
If a process running within Aruba Instant crashes, it may leave behind a "core dump", which contains the memory contents of the process at the time it crashed. It was discovered that core dumps are stored in a way that unauthenticated users can access them through the Aruba Instant web interface. Core dumps could contain sensitive information such as keys and passwords. Workaround: Block access to the Aruba Instant web interface from all untrusted users. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.0 Si un proceso que corre dentro de Aruba Instant se bloquea, puede conllevar a un "volcado de memoria", que contiene la memoria del proceso en el momento en que se bloqueó. • http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-001.txt http://www.securityfocus.com/bid/108374 https://cert-portal.siemens.com/productcert/pdf/ssa-549547.pdf • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •