CVE-2018-7064

{"id": "CVE-2018-7064", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2019-05-10T18:29:03.070", "references": [{"url": "http://www.securityfocus.com/bid/108374", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security-alert@hpe.com"}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-549547.pdf", "tags": ["Patch", "Third Party Advisory"], "source": "security-alert@hpe.com"}, {"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-001.txt", "tags": ["Vendor Advisory"], "source": "security-alert@hpe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A reflected cross-site scripting (XSS) vulnerability is present in an unauthenticated Aruba Instant web interface. An attacker could use this vulnerability to trick an IAP administrator into clicking a link which could then take administrative actions on the Instant cluster, or expose the session cookie for an administrative session. Workaround: Administrators should make sure they log out of the Aruba Instant UI when not actively managing the system, and should use caution clicking links from external sources while logged into the IAP administrative interface. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.0"}, {"lang": "es", "value": "Una vulnerabilidad de XSS reflejado est\u00e1 presente en una interfaz web de Aruba Instant no autenticada. Un atacante podr\u00eda utilizar esta vulnerabilidad para enga\u00f1ar a un administrador de IAP para que haga clic en un enlace que podr\u00eda realizar acciones administrativas en el cl\u00faster Instant\u00e1neo, o exponer la cookie de sesi\u00f3n para una sesi\u00f3n administrativa. Para evitarlo: Los administradores deben asegurarse de cerrar la sesi\u00f3n de la interfaz de usuario de Aruba Instant cuando no gestionan activamente el sistema, y deben tener cuidado al hacer clic en los enlaces de fuentes externas mientras est\u00e1n conectados a la interfaz administrativa de IAP. Resoluci\u00f3n: Solucionado en Aruba Instant, versiones 4.2.4.12, 6.5.4.11, 8.3.0.6, y 8.4.0.0"}], "lastModified": "2019-05-21T18:48:55.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arubanetworks:aruba_instant:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC1A7F0E-2967-4FFD-AF10-993F73B29C79", "versionEndExcluding": "4.2.4.12", "versionStartIncluding": "4.0"}, {"criteria": "cpe:2.3:a:arubanetworks:aruba_instant:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C4A8C11A-80E4-4927-8794-92AED47956E7", "versionEndExcluding": "6.5.4.11", "versionStartIncluding": "6.5.0"}, {"criteria": "cpe:2.3:a:arubanetworks:aruba_instant:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3571ED0E-9E35-4B7D-80FD-DDD1FC187995", "versionEndExcluding": "8.3.0.6", "versionStartIncluding": "8.3.0"}, {"criteria": "cpe:2.3:a:arubanetworks:aruba_instant:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E269D3DC-0DA7-4FC6-8591-E4B324F9F482", "versionEndExcluding": "8.4.0.1", "versionStartIncluding": "8.4.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:siemens:scalance_w1750d_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C4AB6855-E124-4F3C-9993-647B4AB1ACBF", "versionEndExcluding": "8.4.0.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:siemens:scalance_w1750d:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FBC30055-239F-4BB1-B2D1-E5E35F0D8911"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security-alert@hpe.com"}