CVE-2018-7064

    Dashboard / Vulnerabilities / CVE-2018-7064

    CVE-2018-7064

    Published: 10 May 2019Last Modified: 10 Mar 2026

    Summary:

    Details: A reflected cross-site scripting (XSS) vulnerability is present in an unauthenticated Aruba Instant web interface. An attacker could use this vulnerability to trick an IAP administrator into clicking a link which could then take administrative actions on the Instant cluster, or expose the session cookie for an administrative session. Workaround: Administrators should make sure they log out of the Aruba Instant UI when not actively managing the system, and should use caution clicking links from external sources while logged into the IAP administrative interface. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.0

    References: , http://www.securityfocus.com/bid/108374, https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-001.txt, https://cert-portal.siemens.com/productcert/pdf/ssa-549547.pdf

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2018-7064 | CVE-DB