{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "arubaos",
            "vendor": "arubanetworks",
            "versions": [
              {
                "lessThanOrEqual": "10.6.0.2",
                "status": "affected",
                "version": "10.6.0.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "8.10.0.13",
                "status": "affected",
                "version": "8.10.0.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "10.6.0.0",
                "status": "affected",
                "version": "10.5.0.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "10.4.0.0",
                "status": "affected",
                "version": "10.3.0.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "8.12.0.0",
                "status": "affected",
                "version": "8.11.0.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "8.12.0.1",
                "status": "affected",
                "version": "8.12.0.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "8.9.0.0",
                "status": "affected",
                "version": "6.5.4.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42502",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-18T14:30:56.922591Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-78",
                "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-18T14:38:16.739Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Aruba OS",
          "vendor": "Hewlett Packard Enterprise (HPE)",
          "versions": [
            {
              "lessThanOrEqual": "\u003c=10.6.0.2",
              "status": "affected",
              "version": "Version 10.6.0.0: 10.6.0.2 and below",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c=8.10.0.13",
              "status": "affected",
              "version": "Version 8.10.0.0: 8.10.0.13 and below",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c=10.6.0.0",
              "status": "affected",
              "version": "Version 10.5.0.0: 10.6.0.0 and below",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c=10.4.0.0",
              "status": "affected",
              "version": "Version 10.3.0.0: 10.4.0.0 and below",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c=8.12.0.0",
              "status": "affected",
              "version": "Version 8.11.0.0: 8.12.0.0 and below",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c=8.12.0.1",
              "status": "affected",
              "version": "Version 8.12.0.0: 8.12.0.1 and below",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c=8.9.0.0",
              "status": "affected",
              "version": "Version 6.5.4.0: 8.9.0.0 and below",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "erikdejong"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAuthenticated command injection vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability result in the ability to inject shell commands on the underlying operating system.\u003c/p\u003e"
            }
          ],
          "value": "Authenticated command injection vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability result in the ability to inject shell commands on the underlying operating system."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-17T17:14:54.458Z",
        "orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
        "shortName": "hpe"
      },
      "references": [
        {
          "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04709en_us\u0026docLocale=en_US"
        }
      ],
      "source": {
        "advisory": "HPESBNW04709",
        "discovery": "EXTERNAL"
      },
      "title": "Authenticated Remote Command Execution (RCE) Vulnerability in the AOS Command Line Interface",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
    "assignerShortName": "hpe",
    "cveId": "CVE-2024-42502",
    "datePublished": "2024-09-17T17:14:54.458Z",
    "dateReserved": "2024-08-02T17:04:57.631Z",
    "dateUpdated": "2024-09-18T14:38:16.739Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-42502\",\"sourceIdentifier\":\"security-alert@hpe.com\",\"published\":\"2024-09-17T18:15:04.527\",\"lastModified\":\"2024-09-20T12:30:51.220\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Authenticated command injection vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability result in the ability to inject shell commands on the underlying operating system.\"},{\"lang\":\"es\",\"value\":\"Existe una vulnerabilidad de inyecci\u00f3n de comandos autenticados en la interfaz de l\u00ednea de comandos de ArubaOS. La explotaci\u00f3n exitosa de esta vulnerabilidad da como resultado la capacidad de inyectar comandos de shell en el sistema operativo subyacente.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-alert@hpe.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"references\":[{\"url\":\"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04709en_us\u0026docLocale=en_US\",\"source\":\"security-alert@hpe.com\"}]}}"
  }
}