#VU50920 XML External Entity injection in AirWave Management Platform - CVE-2021-26969

Vulnerability identifier: #VU50920

Vulnerability risk: Low

CVSSv4.0: 4.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-26969

CWE-ID: CWE-611

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
AirWave Management Platform
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor: Aruba Networks

Description

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input in the web-based management interface. A remote administrator can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system, leading to denial of service (DoS) attack.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

AirWave Management Platform: before 8.2.12.0

---

External links
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-005.txt

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.