Information disclosure in ArubaOS (AOS) - CVE-2017-9000
Published: October 24, 2017
Vulnerability identifier: #VU8914
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2017-9000
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Aruba Networks
Affected software:
ArubaOS (AOS)
ArubaOS (AOS)
Detailed vulnerability description
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The weakness exists due to improper access control. A remote attacker with network access to an Aruba mobility controller on TCP port 8080 or 8081 can access files which could contain passwords, keys, and other sensitive information.
The weakness exists due to improper access control. A remote attacker with network access to an Aruba mobility controller on TCP port 8080 or 8081 can access files which could contain passwords, keys, and other sensitive information.
How to mitigate CVE-2017-9000
The vulnerability is addressed in the following versions: 6.3.1.25, 6.4.4.16, 6.5.1.9, 6.5.3.3, 6.5.4.2, 8.1.0.4.