Medium severity · published Sep 13, 2019
CVE-2019-5314
Some web components in the ArubaOS software are vulnerable to HTTP Response splitting (CRLF injection) and Reflected XSS
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
Some web components in the ArubaOS software are vulnerable to HTTP Response splitting (CRLF injection) and Reflected XSS. An attacker would be able to accomplish this by sending certain URL parameters that would trigger this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Arubaos · Arubanetworks
before 6.4.4.20; 6.5.4.0 before 6.5.4.11; 6.5.4.12 before 8.2.1.0; 8.2.1.1 before 8.3.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-5314
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-5314
Vendor Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-004.txt
More from Arubaos
9.8
CVE-2024-42509
Unauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol
9.8
CVE-2024-42507
Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol
9.8
CVE-2024-42506
Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol
9.8
CVE-2024-42505
Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol
9.8
CVE-2024-42393
Unauthenticated Stack-Based Buffer Overflow Remote Command Execution (RCE) in the Soft AP Daemon Service Accessed by the PAPI Protocol