VulnerabilityModified
CVE-2019-5323
There are command injection vulnerabilities present in the AirWave application.
HIGH 7.2EPSS 2.56%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.56%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
There are command injection vulnerabilities present in the AirWave application. Certain input fields controlled by an administrative user are not properly sanitized before being parsed by AirWave. If conditions are met, an attacker can obtain command execution on the host.
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.56% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-77
- Affected
- arubanetworks/airwave
- Source
- security-alert@hpe.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.