8.8

CVE-2021-37725

A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.8.0.1, 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.15. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.

Data is provided by the National Vulnerability Database (NVD)
Arubanetworks ≫ Sd-wan Version >= 2.2.0.0 < 2.2.0.4
Arubanetworks ≫ Arubaos Version >= 8.3.0.0 < 8.3.0.15
Arubanetworks ≫ Arubaos Version >= 8.5.0.0 < 8.5.0.12
Arubanetworks ≫ Arubaos Version >= 8.6.0.0 < 8.6.0.8
Arubanetworks ≫ Arubaos Version >= 8.7.0.0 < 8.7.1.2
Arubanetworks ≫ Arubaos Version >= 8.8.0.0 < 8.8.0.1
Siemens ≫ Scalance W1750d Firmware Version < 8.7.1.3
   Siemens ≫ Scalance W1750d Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.17% 0.346
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
nvd@nist.gov 8.8 8.6 9.2
AV:N/AC:M/Au:N/C:N/I:C/A:C
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.