CVE-2023-22756 : There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthent

There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code execution by sending specially crafted packets via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.

Published 2023-03-01 08:15:13

Updated 2023-03-10 19:42:18

Source Hewlett Packard Enterprise (HPE)

View at NVD, CVE.org

Vulnerability category: OverflowExecute code

Exploit prediction scoring system (EPSS) score for CVE-2023-22756

EPSS FAQ

0.38%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 73 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-22756

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.1	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	2.2	5.9	Hewlett Packard Enterprise (HPE)
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-22756

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

Assigned by: nvd@nist.gov (Primary)

Products affected by CVE-2023-22756

Arubanetworks » Arubaos
Versions from including (>=) 8.6.0.0 and up to, including, (<=) 8.6.0.19
cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
Matching versions
Arubanetworks » Arubaos
Versions from including (>=) 10.3.0.0 and up to, including, (<=) 10.3.1.0
cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
Matching versions
Arubanetworks » Arubaos
Versions from including (>=) 8.10.0.0 and up to, including, (<=) 8.10.0.4
cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
Matching versions
Arubanetworks » Sd-wan
Versions from including (>=) 8.7.0.0-2.3.0.0 and up to, including, (<=) 8.7.0.0-2.3.0.8
cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2023-22756

Exploit prediction scoring system (EPSS) score for CVE-2023-22756

CVSS scores for CVE-2023-22756

CWE ids for CVE-2023-22756

References for CVE-2023-22756

Products affected by CVE-2023-22756