« Volver al listado

CVE-2025-27084

Estado: AnalizadaMedia (6.1)—

A vulnerability in the Captive Portal of an AOS-10 GW and AOS-8 Controller/Mobility Conductor could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack. Successful exploitation could enable the attacker to execute arbitrary script code in the victim's browser within the context of the affected interface.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Arubanetworks — Arubaos

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-27084",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-27084",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-09T17:44:41.072819Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-alert@hpe.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-alert@hpe.com",
      "affectedData": [
        {
          "vendor": "Hewlett Packard Enterprise (HPE)",
          "product": "HPE Aruba Networking AOS",
          "versions": [
            {
              "status": "affected",
              "version": "10.7.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "10.7.1.0"
            },
            {
              "status": "affected",
              "version": "10.4.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "10.4.1.6"
            },
            {
              "status": "affected",
              "version": "8.12.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "8.12.0.3"
            },
            {
              "status": "affected",
              "version": "8.10.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "8.10.0.15"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-04-08T17:15:36.700",
  "references": [
    {
      "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04845en_us&docLocale=en_US",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-alert@hpe.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the Captive Portal of an AOS-10 GW and AOS-8 Controller/Mobility Conductor could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack. Successful exploitation could enable the attacker to execute arbitrary script code in the victim's browser within the context of the affected interface."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el portal cautivo de un controlador/conductor de movilidad AOS-10 GW y AOS-8 podría permitir a un atacante remoto realizar un ataque de cross-site scripting (XSS) reflejado. Una explotación exitosa podría permitir al atacante ejecutar código de script arbitrario en el navegador de la víctima dentro del contexto de la interfaz afectada."
    }
  ],
  "lastModified": "2026-06-17T09:03:00.087",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0CED59C2-5A53-4ECF-9D35-F9B3405F16AC",
              "versionEndExcluding": "8.10.0.16",
              "versionStartIncluding": "8.10.0.0"
            },
            {
              "criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9F2F0974-D280-441C-8960-9A78D8023B33",
              "versionEndExcluding": "8.12.0.4",
              "versionStartIncluding": "8.12.0.0"
            },
            {
              "criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79C7B215-E31F-403F-966D-166BE437CD47",
              "versionEndExcluding": "10.4.1.7",
              "versionStartIncluding": "10.4.0.0"
            },
            {
              "criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D164E342-F37B-40FA-BADA-984BDD5D6E8F",
              "versionEndExcluding": "10.7.1.1",
              "versionStartIncluding": "10.7.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-alert@hpe.com"
}