VulnerabilityModified

CVE-2023-22771

An insufficient session expiration vulnerability exists in the ArubaOS command line interface.

LOW 2.4EPSS 0.44%

Does this matter?

Lower severity and a low EPSS score (0.44%). Track it; it rarely justifies an emergency change on its own.

Description

An insufficient session expiration vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability allows an attacker to keep a session running on an affected device after the removal of the impacted account

CVSS 3.1: 2.4 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
EPSS: 0.44% probability · 37th percentile
CISA KEV: Not listed
Weakness: CWE-613
Affected: arubanetworks/arubaos · arubanetworks/sd-wan
Source: security-alert@hpe.com

References

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txtVendor Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txtVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.