CVE-2018-7064

A reflected cross-site scripting (XSS) vulnerability is present in an unauthenticated Aruba Instant web interface. An attacker could use this vulnerability to trick an IAP administrator into clicking a link which could then take administrative actions on the Instant cluster, or expose the session cookie for an administrative session. Workaround: Administrators should make sure they log out of the Aruba Instant UI when not actively managing the system, and should use caution clicking links from external sources while logged into the IAP administrative interface. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.0

• CWE-79

• http://www.securityfocus.com/bid/108374Third Party Advisory, VDB Entry
• https://cert-portal.siemens.com/productcert/pdf/ssa-549547.pdfPatch, Third Party Advisory
• https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-001.txtVendor Advisory
• http://www.securityfocus.com/bid/108374Third Party Advisory, VDB Entry
• https://cert-portal.siemens.com/productcert/pdf/ssa-549547.pdfPatch, Third Party Advisory
• https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-001.txtVendor Advisory

Published

May 10, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-7058Aruba ClearPass, all versions of 6.6.x prior to 6.6.9 are af…
• CVE-2018-7059Aruba ClearPass prior to 6.6.9 has a vulnerability in the AP…
• CVE-2018-7060Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.…
• CVE-2018-7061Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-7062Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-7063In Aruba ClearPass, disabled API admins can still perform re…
• CVE-2018-7065An authenticated SQL injection vulnerability in Aruba ClearP…
• CVE-2018-7066An unauthenticated remote command execution exists in Aruba …
• CVE-2018-7067A Remote Authentication bypass in Aruba ClearPass Policy Man…
• CVE-2018-7068HPE has identified a remote HOST header attack vulnerability…
• CVE-2018-7069HPE has identified a remote unauthenticated access to files …
• CVE-2018-7070HPE has identified a remote disclosure of information vulner…