fkie_nvd - fkie_cve-2024-47463

fkie_cve-2024-47463

Vulnerability from fkie_nvd

Published

2024-11-05 23:15

Modified

2024-11-06 18:17

Severity ?

7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could allow an authenticated remote attacker to create arbitrary files, which could lead to a remote command execution (RCE) on the underlying operating system.

References

▼	URL	Tags
	security-alert@hpe.com	https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us&docLocale=en_US

Impacted products

	Vendor	Product	Version

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could allow an authenticated remote attacker to create arbitrary files, which could lead to a remote command execution (RCE) on the underlying operating system."
    },
    {
      "lang": "es",
      "value": " Existe una vulnerabilidad de creaci\u00f3n de archivos arbitrarios en la interfaz de l\u00ednea de comandos de Instant AOS-8 y AOS-10. La explotaci\u00f3n exitosa de esta vulnerabilidad podr\u00eda permitir que un atacante remoto autenticado cree archivos arbitrarios, lo que podr\u00eda provocar una ejecuci\u00f3n remota de comandos (RCE) en el sistema operativo subyacente."
    }
  ],
  "id": "CVE-2024-47463",
  "lastModified": "2024-11-06T18:17:17.287",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "security-alert@hpe.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-11-05T23:15:04.123",
  "references": [
    {
      "source": "security-alert@hpe.com",
      "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us\u0026docLocale=en_US"
    }
  ],
  "sourceIdentifier": "security-alert@hpe.com",
  "vulnStatus": "Awaiting Analysis"
}

cve-2024-47463

Vulnerability from cvelistv5

Published

2024-11-05 22:59

Modified

2024-11-09 04:55

Severity ?

7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could allow an authenticated remote attacker to create arbitrary files, which could lead to a remote command execution (RCE) on the underlying operating system.

References

▼	URL	Tags
	https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us&docLocale=en_US

Impacted products

	Vendor	Product	Version
	Hewlett Packard Enterprise (HPE)	HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10	Version: AOS-10.4.x.x: 10.4.1.4 and below ≤ <=10.4.1.4 Version: Instant AOS-8.12.x.x: 8.12.0.2 and below ≤ <=8.12.0.2 Version: Instant AOS-8.10.x.x: 8.10.0.13 and below ≤ <=8.10.0.13

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "arubaos",
            "vendor": "arubanetworks",
            "versions": [
              {
                "lessThanOrEqual": "10.4.1.4",
                "status": "affected",
                "version": "10.4.0.0",
                "versionType": "semver"
              },
              {
                "lessThan": "10.4.0.0",
                "status": "affected",
                "version": "10.3.0.0",
                "versionType": "semver"
              },
              {
                "lessThan": "10.7.0.0",
                "status": "affected",
                "version": "10.5.0.0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "instant",
            "vendor": "arubanetworks",
            "versions": [
              {
                "lessThanOrEqual": "8.12.0.2",
                "status": "affected",
                "version": "8.12.0.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "8.10.0.13",
                "status": "affected",
                "version": "8.10.0.0",
                "versionType": "semver"
              },
              {
                "lessThan": "6.6.0.0",
                "status": "affected",
                "version": "6.4.0.0",
                "versionType": "semver"
              },
              {
                "lessThan": "8.10.0.0",
                "status": "affected",
                "version": "8.4.0.0",
                "versionType": "semver"
              },
              {
                "lessThan": "8.12.0.0",
                "status": "affected",
                "version": "8.11.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47463",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-08T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-09T04:55:52.279Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10",
          "vendor": "Hewlett Packard Enterprise (HPE)",
          "versions": [
            {
              "lessThanOrEqual": "\u003c=10.4.1.4",
              "status": "affected",
              "version": "AOS-10.4.x.x: 10.4.1.4 and below",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c=8.12.0.2",
              "status": "affected",
              "version": "Instant AOS-8.12.x.x: 8.12.0.2 and below",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c=8.10.0.13",
              "status": "affected",
              "version": "Instant AOS-8.10.x.x: 8.10.0.13 and below",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "zzcentury from Ubisectech Sirius Team (https://www.ubisectech.com/)"
        }
      ],
      "datePublic": "2024-11-05T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003eAn arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could allow an authenticated remote attacker to create arbitrary files, which could lead to a remote command execution (RCE) on the underlying operating system.\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could allow an authenticated remote attacker to create arbitrary files, which could lead to a remote command execution (RCE) on the underlying operating system."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-05T22:59:04.966Z",
        "orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
        "shortName": "hpe"
      },
      "references": [
        {
          "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us\u0026docLocale=en_US"
        }
      ],
      "source": {
        "advisory": "HPESBNW04722",
        "discovery": "EXTERNAL"
      },
      "title": "Arbitrary File Creation Vulnerability in Instant AOS-8 and AOS-10 leads to Authenticated Remote Command Execution (RCE)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
    "assignerShortName": "hpe",
    "cveId": "CVE-2024-47463",
    "datePublished": "2024-11-05T22:59:04.966Z",
    "dateReserved": "2024-09-24T18:13:23.209Z",
    "dateUpdated": "2024-11-09T04:55:52.279Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.