Lucene search

MitreCVE-2008-7023

HistoryAug 21, 2009 - 2:30 p.m.

CVE-2008-7023

2009-08-2114:30:00

CWE-310

mitre

web.nvd.nist.gov

aruba mobility controller

arubaos

authentication bypass

x.509 certificate

nvd

vulnerability

security recommendation

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

AI Score

Confidence

Low

EPSS

0.003

Percentile

71.2%

JSON

Aruba Mobility Controller running ArubaOS 3.3.1.16, and possibly other versions, installs the same default X.509 certificate for all installations, which allows remote attackers to bypass authentication. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product’s security documentation.

Affected configurations

Nvd

Node

arubanetworksaruba_mobility_controllerMatch-

AND

arubanetworksarubaosMatch3.3.1.16

VendorProductVersionCPE
arubanetworksaruba_mobility_controller-cpe:2.3:h:arubanetworks:aruba_mobility_controller:-:*:*:*:*:*:*:*
arubanetworksarubaos3.3.1.16cpe:2.3:o:arubanetworks:arubaos:3.3.1.16:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
arubanetworks	aruba_mobility_controller	-	cpe:2.3:h:arubanetworks:aruba_mobility_controller:-:::::::*
arubanetworks	arubaos	3.3.1.16	cpe:2.3:o:arubanetworks:arubaos:3.3.1.16:::::::*

References

osvdb.org/51731

www.securityfocus.com/archive/1/496604/100/0/threaded

www.securityfocus.com/archive/1/496622/100/0/threaded

www.securityfocus.com/bid/31336

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

AI Score

Confidence

Low

EPSS

0.003

Percentile

71.2%

JSON

Related for CVE-2008-7023