CVE-2021-26969: arubanetworks airwave

Vulnerability summary

CVE-2021-26969 is a medium (CVSS 6.5) vulnerability in arubanetworks airwave. EPSS estimates a 1.46% chance of exploitation in the next 30 days, higher than 73.2% of scored vulnerabilities.

Timeline

1. 05-03-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A remote authenticated authenticated xml external entity (xxe) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Due to improper restrictions on XML entities a vulnerability exists in the web-based management interface of AirWave. A successful exploit could allow an authenticated attacker to retrieve files from the local system or cause the application to consume system resources, resulting in a denial of service condition.

• CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.