CVE-2022-37909CWE-200information-disclosure

CVE-2022-37909

Medium · published December 12, 2022

CVSS v3.1
5.3
EPSS
0%
Percentile
19.1
In the wild
Unconfirmed
What it is

Aruba has identified certain configurations of ArubaOS that can lead to sensitive information disclosure from the configured ESSIDs. The scenarios in which disclosure of potentially sensitive information can occur are complex, and depend on factors beyond the control of attackers.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00277 · 19.1th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2022-12-12T18:15Z
Affected products (6)
ProductVersionsFixed in
arubanetworks/sd-wan≥ 8.5.0.0-2.1.0.0, < 8.7.0.0-2.3.0.78.7.0.0-2.3.0.7
arubanetworks/arubaos≥ 6.5.4.0, < 6.5.4.236.5.4.23
arubanetworks/arubaos≥ 8.4.0.0, < 8.6.0.188.6.0.18
arubanetworks/arubaos≥ 8.7.0.0, < 8.7.1.108.7.1.10
arubanetworks/arubaos≥ 8.8.0.0, < 8.10.0.08.10.0.0
arubanetworks/arubaosall versions—
References (2)
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt · [email protected]https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 03 NOV 19:31Z
    Aruba has identified certain configurations of ArubaOS that can lead to sensitive information disclosure from the configured ESSIDs
    cvelistv5