CVE-2024-31483

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An authenticated sensitive information disclosure vulnerability exists in the CLI service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to read arbitrary files in the underlying operating system.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	AOS-8 Instant and AOS-10 AP	>= 10.5.0.0, <= 10.5.1.0; >= 10.4.0.0, <= 10.4.1.0; >= 8.11.0.0, <= 8.11.2.1; >= 8.10.0.0, <= 8.10.0.10; >= 8.6.0.0, <= 8.6.0.23
arubanetworks	arubaos	>= 10.5.0.0, <= 10.5.1.0
arubanetworks	arubaos	>= 10.4.0.0, <= 10.4.1.0
arubanetworks	instant	>= 8.10.0.0, <= 8.10.0.10
arubanetworks	instant	>= 8.11.0.0, <= 8.11.2.1
arubanetworks	instant	>= 8.6.0.0, <= 8.6.0.23
arubanetworks	arubaos	>= 10.3.0.0, < 10.4.0.0
arubanetworks	instant	>= 8.9.0.0, < 8.10.0.0
arubanetworks	instant	>= 8.8.0.0, < 8.9.0.0
arubanetworks	instant	>= 8.5.0.0, < 8.6.0.0
arubanetworks	instant	>= 8.7.0.0, < 8.8.0.0
arubanetworks	instant	>= 8.4.0.0, < 8.5.0.0
arubanetworks	instant	>= 6.5.0.0, < 6.6.0.0
arubanetworks	instant	>= 6.4.0.0, < 6.5.0.0

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txtBroken Link, Vendor Advisory

Timeline

Published: May 14, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-314847.8A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central Processing/Communicati CVE-2024-314857.2A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.30), SICORE Base system (All versions < V1 CVE-2024-314865.3A vulnerability has been identified in OPUPI0 AMQP/MQTT (All versions < V5.30). The affected devices stores MQTT client passwords without su CVE-2024-314876.5A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4,CVE-2024-314889.0An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 throug CVE-2024-314898.1AAn improper certificate validation vulnerability [CWE-295] in FortiClientWindows 7.2.0 through 7.2.2, 7.0.0 through 7.0.11, FortiClientLin CVE-2024-31498.8A Server-Side Request Forgery (SSRF) vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature, intended f CVE-2024-314906.5An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 CVE-2024-314918.8A client-side enforcement of server-side security vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2 CVE-2024-314927.8An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and below, version 7.0.10 and below install CVE-2024-314936.5An improper removal of sensitive information before storage or transfer vulnerability [CWE-212] in FortiSOAR version 7.3.0, version 7.2.2 an CVE-2024-314952.7A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.0.0 through 7.0.6