An insufficient session expiration vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability allows an attacker to keep a session running on an affected device after the removal of the impacted account
According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Arubaos | Arubanetworks | 8.6.0.0 (including) | 8.6.0.19 (including) |
| Arubaos | Arubanetworks | 8.10.0.0 (including) | 8.10.0.4 (including) |
| Arubaos | Arubanetworks | 10.3.0.0 (including) | 10.3.1.0 (including) |