CVE-2024-1356 - OpenCVE

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt

History

No history.

MITRE

Status: PUBLISHED

Assigner: hpe

Published: 2024-03-05T20:14:37.530Z

Updated: 2024-08-01T18:33:25.382Z

Reserved: 2024-02-08T18:15:17.017Z

Link: CVE-2024-1356

Vulnrichment

Updated: 2024-08-01T18:33:25.382Z

NVD

Status : Awaiting Analysis

Published: 2024-03-05T21:15:07.593

Modified: 2024-07-03T01:45:11.987

Link: CVE-2024-1356

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-1356", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "state": "PUBLISHED", "assignerShortName": "hpe", "dateReserved": "2024-02-08T18:15:17.017Z", "datePublished": "2024-03-05T20:14:37.530Z", "dateUpdated": "2024-08-01T18:33:25.382Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "ArubaOS Wi-Fi Controllers and Campus/Remote Access Points", "vendor": "Hewlett Packard Enterprise (HPE)", "versions": [{"status": "affected", "version": "ArubaOS 10.5.x.x: 10.5.0.1 and below"}, {"status": "affected", "version": "ArubaOS 10.4.x.x: 10.4.0.3 and below"}, {"status": "affected", "version": "ArubaOS 8.11.x.x: 8.11.2.0 and below"}, {"status": "affected", "version": "ArubaOS 8.10.x.x: 8.10.0.9 and below"}]}], "credits": [{"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "Erik De Jong (bugcrowd.com/erikdejong)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.</p>"}], "value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2024-03-05T20:14:37.530Z"}, "references": [{"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "affected": [{"vendor": "arubanetworks", "product": "arubaos", "cpes": ["cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "10.5.0.0", "status": "affected", "lessThanOrEqual": "10.5.0.1", "versionType": "custom"}]}, {"vendor": "arubanetworks", "product": "arubaos", "cpes": ["cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "10.4.0.0", "status": "affected", "lessThanOrEqual": "10.4.0.3", "versionType": "custom"}]}, {"vendor": "arubanetworks", "product": "arubaos", "cpes": ["cpe:2.3:o:arubanetworks:arubaos:8.11.0.0:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "8.11.0.0", "status": "affected", "lessThanOrEqual": "8.11.2.0", "versionType": "custom"}]}, {"vendor": "arubanetworks", "product": "arubaos", "cpes": ["cpe:2.3:o:arubanetworks:arubaos:8.10.0.0:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "8.10.0.0", "status": "affected", "lessThanOrEqual": "8.10.0.9", "versionType": "custom"}]}, {"vendor": "arubanetworks", "product": "arubaos", "cpes": ["cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "10.3.0.0", "status": "affected", "lessThan": "10.4.0.0", "versionType": "custom"}]}, {"vendor": "arubanetworks", "product": "arubaos", "cpes": ["cpe:2.3:o:arubanetworks:arubaos:8.9.0.0:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "8.9.0.0", "status": "affected", "lessThan": "8.10.0.0", "versionType": "custom"}]}, {"vendor": "arubanetworks", "product": "arubaos", "cpes": ["cpe:2.3:o:arubanetworks:arubaos:8.8.0.0:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "8.8.0.0", "status": "affected", "lessThan": "8.9.0.0", "versionType": "custom"}]}, {"vendor": "arubanetworks", "product": "arubaos", "cpes": ["cpe:2.3:o:arubanetworks:arubaos:8.7.0.0:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "8.7.0.0", "status": "affected", "lessThan": "8.8.0.0", "versionType": "custom"}]}, {"vendor": "arubanetworks", "product": "arubaos", "cpes": ["cpe:2.3:o:arubanetworks:arubaos:8.6.0.0:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "8.6.0.0", "status": "affected", "lessThan": "8.7.0.0", "versionType": "custom"}]}, {"vendor": "arubanetworks", "product": "arubaos", "cpes": ["cpe:2.3:o:arubanetworks:arubaos:6.5.4.0:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "6.5.4.0", "status": "affected", "lessThan": "6.5.5.0", "versionType": "custom"}]}, {"vendor": "arubanetworks", "product": "sd-wan", "cpes": ["cpe:2.3:a:arubanetworks:sd-wan:8.7.0.0:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "8.7.0.0", "status": "affected", "lessThan": "8.8.0.0", "versionType": "custom"}]}, {"vendor": "arubanetworks", "product": "sd-wan", "cpes": ["cpe:2.3:a:arubanetworks:sd-wan:8.6.0.4:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "8.6.0.4", "status": "affected", "lessThan": "8.7.0.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-03-29T04:00:15.641283Z", "id": "CVE-2024-1356", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-20T19:17:58.253Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:33:25.382Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:33:25.382Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-1356", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-03-29T04:00:15.641283Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "arubaos", "versions": [{"status": "affected", "version": "10.5.0.0", "versionType": "custom", "lessThanOrEqual": "10.5.0.1"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "arubaos", "versions": [{"status": "affected", "version": "10.4.0.0", "versionType": "custom", "lessThanOrEqual": "10.4.0.3"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:o:arubanetworks:arubaos:8.11.0.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "arubaos", "versions": [{"status": "affected", "version": "8.11.0.0", "versionType": "custom", "lessThanOrEqual": "8.11.2.0"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:o:arubanetworks:arubaos:8.10.0.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "arubaos", "versions": [{"status": "affected", "version": "8.10.0.0", "versionType": "custom", "lessThanOrEqual": "8.10.0.9"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "arubaos", "versions": [{"status": "affected", "version": "10.3.0.0", "lessThan": "10.4.0.0", "versionType": "custom"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:o:arubanetworks:arubaos:8.9.0.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "arubaos", "versions": [{"status": "affected", "version": "8.9.0.0", "lessThan": "8.10.0.0", "versionType": "custom"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:o:arubanetworks:arubaos:8.8.0.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "arubaos", "versions": [{"status": "affected", "version": "8.8.0.0", "lessThan": "8.9.0.0", "versionType": "custom"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:o:arubanetworks:arubaos:8.7.0.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "arubaos", "versions": [{"status": "affected", "version": "8.7.0.0", "lessThan": "8.8.0.0", "versionType": "custom"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:o:arubanetworks:arubaos:8.6.0.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "arubaos", "versions": [{"status": "affected", "version": "8.6.0.0", "lessThan": "8.7.0.0", "versionType": "custom"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:o:arubanetworks:arubaos:6.5.4.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "arubaos", "versions": [{"status": "affected", "version": "6.5.4.0", "lessThan": "6.5.5.0", "versionType": "custom"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:a:arubanetworks:sd-wan:8.7.0.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "sd-wan", "versions": [{"status": "affected", "version": "8.7.0.0", "lessThan": "8.8.0.0", "versionType": "custom"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:a:arubanetworks:sd-wan:8.6.0.4:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "sd-wan", "versions": [{"status": "affected", "version": "8.6.0.4", "lessThan": "8.7.0.0", "versionType": "custom"}], "defaultStatus": "affected"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-20T19:17:41.625Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "Erik De Jong (bugcrowd.com/erikdejong)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hewlett Packard Enterprise (HPE)", "product": "ArubaOS Wi-Fi Controllers and Campus/Remote Access Points", "versions": [{"status": "affected", "version": "ArubaOS 10.5.x.x: 10.5.0.1 and below"}, {"status": "affected", "version": "ArubaOS 10.4.x.x: 10.4.0.3 and below"}, {"status": "affected", "version": "ArubaOS 8.11.x.x: 8.11.2.0 and below"}, {"status": "affected", "version": "ArubaOS 8.10.x.x: 8.10.0.9 and below"}], "defaultStatus": "affected"}], "references": [{"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n", "supportingMedia": [{"type": "text/html", "value": "<p>Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.</p>", "base64": false}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2024-03-05T20:14:37.530Z"}}}, "cveMetadata": {"cveId": "CVE-2024-1356", "state": "PUBLISHED", "dateUpdated": "2024-08-01T18:33:25.382Z", "dateReserved": "2024-02-08T18:15:17.017Z", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "datePublished": "2024-03-05T20:14:37.530Z", "assignerShortName": "hpe"}, "dataVersion": "5.1"}