1. Home
  2. CVE Database
  3. CVE-2021-26966
MEDIUM · 6.5

CVE-2021-26966

A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Multiple vulnerabilities in the API of AirWave could allow an auth...

Vulnerability Description

A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Multiple vulnerabilities in the API of AirWave could allow an authenticated remote attacker to conduct SQL injection attacks against the AirWave instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
ArubanetworksAirwave< 8.2.12.0

Related Weaknesses (CWE)

CWE-89

References

FAQ

What is CVE-2021-26966?

CVE-2021-26966 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Multiple vulnerabilities in the API of AirWave could allow an auth...

How severe is CVE-2021-26966?

CVE-2021-26966 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-26966?

Check the references section above for vendor advisories and patch information. Affected products include: Arubanetworks Airwave.