CVE-2023-22778

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

A vulnerability in the ArubaOS web management interface could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
Hewlett Packard Enterprise (HPE)Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba CentralArubaOS 8.6.x.x: 8.6.0.19 and below; ArubaOS 8.10.x.x: 8.10.0.4 and below; ArubaOS 10.3.x.x: 10.3.1.0 and below; SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below

References

Timeline

Published
Mar 1, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-227799.8There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendinCVE-2023-22789.8The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9 via the 'wdk_public_CVE-2023-227809.8There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendinCVE-2023-227819.8There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendinCVE-2023-227829.8There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendinCVE-2023-227839.8There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendinCVE-2023-227849.8There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendinCVE-2023-227859.8There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendinCVE-2023-227869.8There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendinCVE-2023-227877.5An unauthenticated Denial of Service (DoS) vulnerability exists in a service accessed via the PAPI protocol provided by Aruba InstantOS and CVE-2023-227888.8Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful explCVE-2023-227898.8Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful expl
CVE-2023-22778: Medium severity, CVSS 4.8 | Vulnix