CVE-2013-2290: XSS
Published Mar 28, 2013
·Updated
Cross-site scripting (XSS) vulnerability in the dashboard of the ArubaOS Administration WebUI in Aruba Networks ArubaOS 6.2.x before 6.2.0.3, 6.1.3.x before 6.1.3.7, 6.1.x-FIPS before 6.1.4.3-FIPS, and 6.1.x-AirGroup before 6.1.3.6-AirGroup, as used by Mobility Controller, allows remote wireless access points to inject arbitrary web script or HTML via a crafted SSID.
Affected Software
11 affected components
Arubanetworks Arubaos=6.2.0.0
Arubanetworks Arubaos=6.2.0.1
Arubanetworks Arubaos=6.2.0.2
Arubanetworks Arubaos=6.1.3.0
Arubanetworks Arubaos=6.1.3.1
Arubanetworks Arubaos=6.1.3.2
Arubanetworks Arubaos=6.1.3.4
Arubanetworks Arubaos=6.1.3.5
Arubanetworks Arubaos=6.1.3.6
Arubanetworks Arubaos=6.1.2.3
Arubanetworks Arubaos=6.1.4.2
Event History
Mar 28, 2013
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
Who is impacted by CVE-2013-2290?
Anyone using affected versions of Aruba Networks ArubaOS, specifically in settings where the Administration WebUI is accessible, is at risk.