CVE-2020-24641: arubanetworks airwave_glass Improper Authentication
Vulnerability summary
CVE-2020-24641 is a high (CVSS 7.5) Improper Authentication vulnerability in arubanetworks airwave_glass. EPSS estimates a 1.48% chance of exploitation in the next 30 days, higher than 73.5% of scored vulnerabilities.
Timeline
- 15-01-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Aruba AirWave Glass before 1.3.3, there is a Server-Side Request Forgery vulnerability through an unauthenticated endpoint that if successfully exploited can result in disclosure of sensitive information. This can be used to perform an authentication bypass and ultimately gain administrative access on the web administrative interface.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.48%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
+0.02 pp
From 1.46% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected systems
Arubanetworks1 product
- airwave_glass< 1.3.3
1 vendor · 1 product