#VU8914 Information disclosure in ArubaOS (AOS) - CVE-2017-9000
Published: October 24, 2017
Vulnerability identifier: #VU8914
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2017-9000
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
ArubaOS (AOS)
ArubaOS (AOS)
Software vendor:
Aruba Networks
Aruba Networks
Description
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The weakness exists due to improper access control. A remote attacker with network access to an Aruba mobility controller on TCP port 8080 or 8081 can access files which could contain passwords, keys, and other sensitive information.
The weakness exists due to improper access control. A remote attacker with network access to an Aruba mobility controller on TCP port 8080 or 8081 can access files which could contain passwords, keys, and other sensitive information.
Remediation
The vulnerability is addressed in the following versions: 6.3.1.25, 6.4.4.16, 6.5.1.9, 6.5.3.3, 6.5.4.2, 8.1.0.4.