// For flags

CVE-2022-37918

Broken Access Control for some Web-based Management URLs in AirWave Management Platform

Severity Score

8.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive information and/or change network configurations with privileges at a higher effective level in Aruba AirWave Management Platform version(s): 8.2.15.0 and below.

Existen vulnerabilidades en la interfaz de administración basada en web de AirWave Management Platform que exponen algunas URL a una falta de controles de acceso adecuados. Estas vulnerabilidades podrían permitir que un atacante remoto con privilegios limitados obtenga acceso a información confidencial y/o cambie las configuraciones de red con privilegios en un nivel efectivo más alto en las versiones de la plataforma de administración Aruba AirWave: 8.2.15.0 y anteriores.

*Credits: oussama sadouki
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Complete
Integrity
Complete
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-08-08 CVE Reserved
  • 2022-12-08 CVE Published
  • 2024-08-03 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
References (1)
URL Tag Source
URL Date SRC
URL Date SRC
URL Date SRC
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-019.txt 2023-11-07
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Arubanetworks
Search vendor "Arubanetworks"
 Airwave
Search vendor "Arubanetworks" for product "Airwave"
 <= 8.2.15.0
Search vendor "Arubanetworks" for product "Airwave" and version " <= 8.2.15.0"
-
Affected