CVE-2023-35971 - Unauthenticated Stored Cross-Site Scripting (XSS) in ArubaOS Web-based Management Interface

Back Back to CVE browser

HIGH

Unauthenticated Stored Cross-Site Scripting (XSS) in ArubaOS Web-based Management Interface

Published Jul 5, 2023

8.8

HIGH

CVSS 3.1

EPSS 0.62%

Description

A vulnerability in the ArubaOS web-based management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

Affected products

Vendor Hewlett Packard Enterprise (HPE) Product n/a Default
affected
- Version
  - ArubaOS 10.4.x.x: 10.4.0.1 and below
  Status
  affected
  Constraints
  -
- Version
  - ArubaOS 8.10.x.x: 8.10.0.6 and below
  Status
  affected
  Constraints
  -
- Version
  - ArubaOS 8.11.x.x: 8.11.1.0 and below
  Status
  affected
  Constraints
  -
- Version
  - ArubaOS 8.6.x.x: 8.6.0.20 and below
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Hewlett Packard Enterprise (HPE)

n/a

affected

Version	Status	Constraints
- ArubaOS 10.4.x.x: 10.4.0.1 and below	affected	-
- ArubaOS 8.10.x.x: 8.10.0.6 and below	affected	-
- ArubaOS 8.11.x.x: 8.11.1.0 and below	affected	-
- ArubaOS 8.6.x.x: 8.6.0.20 and below	affected	-