CVE-2024-31474 - Vulnerability Details - OpenCVE

There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI (Aruba's Access Point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the affected Access Point

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Arubanetworks	Arubaos Instant

No data.

No data.

References

Link	Providers
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt

History

No history.

MITRE

Status: PUBLISHED

Assigner: hpe

Published: 2024-05-14T22:29:51.497Z

Updated: 2024-08-02T01:52:57.090Z

Reserved: 2024-04-03T21:21:22.897Z

Link: CVE-2024-31474

Vulnrichment

Updated: 2024-05-15T13:39:12.869Z

NVD

Status : Awaiting Analysis

Published: 2024-05-14T23:15:10.560

Modified: 2024-11-21T09:13:36.150

Link: CVE-2024-31474

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-31474", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "state": "PUBLISHED", "assignerShortName": "hpe", "dateReserved": "2024-04-03T21:21:22.897Z", "datePublished": "2024-05-14T22:29:51.497Z", "dateUpdated": "2024-08-02T01:52:57.090Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Aruba InstantOS and Aruba Access Points running ArubaOS 10", "vendor": "Hewlett Packard Enterprise (HPE)", "versions": [{"status": "affected", "version": "InstantOS or ArubaOS (access points) 10.5.x.x: 10.5.1.0 and below."}, {"status": "affected", "version": "InstantOS or ArubaOS (access points) 10.4.x.x: 10.4.1.0 and below."}, {"status": "affected", "version": "InstantOS or ArubaOS (access points) 8.11.x.x: 8.11.2.1 and below."}, {"status": "affected", "version": "InstantOS or ArubaOS (access points) 8.10.x.x: 8.10.0.10 and below."}, {"status": "affected", "version": "InstantOS or ArubaOS (access points) 8.6.x.x: 8.6.0.23 and below."}]}], "credits": [{"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "Chancen"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI (Aruba's Access Point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the affected Access Point</p>"}], "value": "There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI (Aruba's Access Point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the affected Access Point\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2024-05-14T22:29:51.497Z"}, "references": [{"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-463", "lang": "en", "description": "CWE-463 Deletion of Data Structure Sentinel"}]}], "affected": [{"vendor": "arubanetworks", "product": "arubaos", "cpes": ["cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "10.5.0.0", "status": "affected", "lessThanOrEqual": "10.5.1.0", "versionType": "custom"}]}, {"vendor": "arubanetworks", "product": "arubaos", "cpes": ["cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "10.4.0.0", "status": "affected", "lessThanOrEqual": "10.4.1.0", "versionType": "custom"}]}, {"vendor": "arubanetworks", "product": "instant", "cpes": ["cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "8.10.0.0", "status": "affected", "lessThanOrEqual": "8.10.0.10", "versionType": "custom"}]}, {"vendor": "arubanetworks", "product": "instant", "cpes": ["cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "8.11.0.0", "status": "affected", "lessThanOrEqual": "8.11.2.1", "versionType": "custom"}]}, {"vendor": "arubanetworks", "product": "instant", "cpes": ["cpe:2.3:o:arubanetworks:instant:8.6.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "8.6.0.0", "status": "affected", "lessThanOrEqual": "8.6.0.23", "versionType": "custom"}]}, {"vendor": "arubanetworks", "product": "arubaos", "cpes": ["cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "10.3.0.0", "status": "affected", "lessThan": "10.4.0.0", "versionType": "custom"}]}, {"vendor": "arubanetworks", "product": "instant", "cpes": ["cpe:2.3:o:arubanetworks:instant:8.9.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "8.9.0.0", "status": "affected", "lessThan": "8.10.0.0", "versionType": "custom"}]}, {"vendor": "arubanetworks", "product": "instant", "cpes": ["cpe:2.3:o:arubanetworks:instant:8.8.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "8.8.0.0", "status": "affected", "lessThan": "8.9.0.0", "versionType": "custom"}]}, {"vendor": "arubanetworks", "product": "instant", "cpes": ["cpe:2.3:o:arubanetworks:instant:8.5.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "8.5.0.0", "status": "affected", "lessThan": "8.6.0.0", "versionType": "custom"}]}, {"vendor": "arubanetworks", "product": "instant", "cpes": ["cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "8.7.0.0", "status": "affected", "lessThan": "8.8.0.0", "versionType": "custom"}]}, {"vendor": "arubanetworks", "product": "instant", "cpes": ["cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "8.4.0.0", "status": "affected", "lessThan": "8.5.0.0", "versionType": "custom"}]}, {"vendor": "arubanetworks", "product": "instant", "cpes": ["cpe:2.3:o:arubanetworks:instant:6.5.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.5.0.0", "status": "affected", "lessThan": "6.6.0.0", "versionType": "custom"}]}, {"vendor": "arubanetworks", "product": "instant", "cpes": ["cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.4.0.0", "status": "affected", "lessThan": "6.5.0.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-05-15T13:39:14.628824Z", "id": "CVE-2024-31474", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-06T16:57:56.588Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:52:57.090Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-31474", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "state": "PUBLISHED", "assignerShortName": "hpe", "dateReserved": "2024-04-03T21:21:22.897Z", "datePublished": "2024-05-14T22:29:51.497Z", "dateUpdated": "2024-06-06T16:57:56.588Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Aruba InstantOS and Aruba Access Points running ArubaOS 10", "vendor": "Hewlett Packard Enterprise (HPE)", "versions": [{"status": "affected", "version": "InstantOS or ArubaOS (access points) 10.5.x.x: 10.5.1.0 and below."}, {"status": "affected", "version": "InstantOS or ArubaOS (access points) 10.4.x.x: 10.4.1.0 and below."}, {"status": "affected", "version": "InstantOS or ArubaOS (access points) 8.11.x.x: 8.11.2.1 and below."}, {"status": "affected", "version": "InstantOS or ArubaOS (access points) 8.10.x.x: 8.10.0.10 and below."}, {"status": "affected", "version": "InstantOS or ArubaOS (access points) 8.6.x.x: 8.6.0.23 and below."}]}], "credits": [{"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "Chancen"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI (Aruba's Access Point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the affected Access Point</p>"}], "value": "There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI (Aruba's Access Point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the affected Access Point\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2024-05-14T22:29:51.497Z"}, "references": [{"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-31474", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-15T13:39:14.628824Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "arubaos", "versions": [{"status": "affected", "version": "10.5.0.0", "versionType": "custom", "lessThanOrEqual": "10.5.1.0"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "arubaos", "versions": [{"status": "affected", "version": "10.4.0.0", "versionType": "custom", "lessThanOrEqual": "10.4.1.0"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "instant", "versions": [{"status": "affected", "version": "8.10.0.0", "versionType": "custom", "lessThanOrEqual": "8.10.0.10"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "instant", "versions": [{"status": "affected", "version": "8.11.0.0", "versionType": "custom", "lessThanOrEqual": "8.11.2.1"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:arubanetworks:instant:8.6.0.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "instant", "versions": [{"status": "affected", "version": "8.6.0.0", "versionType": "custom", "lessThanOrEqual": "8.6.0.23"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "arubaos", "versions": [{"status": "affected", "version": "10.3.0.0", "lessThan": "10.4.0.0", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:arubanetworks:instant:8.9.0.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "instant", "versions": [{"status": "affected", "version": "8.9.0.0", "lessThan": "8.10.0.0", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:arubanetworks:instant:8.8.0.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "instant", "versions": [{"status": "affected", "version": "8.8.0.0", "lessThan": "8.9.0.0", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:arubanetworks:instant:8.5.0.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "instant", "versions": [{"status": "affected", "version": "8.5.0.0", "lessThan": "8.6.0.0", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "instant", "versions": [{"status": "affected", "version": "8.7.0.0", "lessThan": "8.8.0.0", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "instant", "versions": [{"status": "affected", "version": "8.4.0.0", "lessThan": "8.5.0.0", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:arubanetworks:instant:6.5.0.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "instant", "versions": [{"status": "affected", "version": "6.5.0.0", "lessThan": "6.6.0.0", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:*"], "vendor": "arubanetworks", "product": "instant", "versions": [{"status": "affected", "version": "6.4.0.0", "lessThan": "6.5.0.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-463", "description": "CWE-463 Deletion of Data Structure Sentinel"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-15T13:39:12.869Z"}}]}}