CVE-2022-37911

MediumCVSS 5.5/10Last modified Oct 8, 2026

Description

Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS. A successful exploit could allow an authenticated attacker to retrieve files from the local system or cause the application to consume system resources, resulting in a denial of service condition.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published: Dec 12, 2022
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-379128.8Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitie CVE-2022-379139.8Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote att CVE-2022-379149.8Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote att CVE-2022-379159.8A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote att CVE-2022-379168.1Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access co CVE-2022-379178.1Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access co CVE-2022-379188.1Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access co CVE-2022-379197.5A vulnerability exists in the API of Aruba EdgeConnect Enterprise. An unauthenticated attacker can exploit this condition via the web-based CVE-2022-37929.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GullsEye GullsEye terminal operating s CVE-2022-379207.2Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the CVE-2022-379217.2Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the CVE-2022-379227.2Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the