Skip to main content

Airwave CVE-2021-25164

MEDIUM
Improper Restriction of XML External Entity Reference (CWE-611)
2021-04-28 security-alert@hpe.com
XXE Aruba Airwave
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

1
CVE Published
Apr 28, 2021 - 20:15 nvd
MEDIUM 6.5

DescriptionNVD

A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.

AnalysisAI

A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as XML External Entity (XXE) (CWE-611), which allows attackers to read arbitrary files or perform SSRF through XML processing. A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability. Affected products include: Arubanetworks Airwave. Version information: prior to 8.2.12.1..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Disable external entity processing in XML parsers, use JSON instead of XML where possible.

More in Airwave

View all
CVE-2014-8368 CRITICAL
9.0 Nov 25

The web interface in Aruba Networks AirWave before 7.7.14 and 8.x before 8.0.5 allows remote authenticated users to gain
CVE-2021-25167 HIGH
8.8 Apr 29

A remote unauthorized access vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.1
CVE-2021-25166 HIGH
8.8 Apr 29

A remote unauthorized access vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.1
CVE-2021-25151 HIGH
8.8 Apr 28

A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to

CVE-2021-26961 HIGH
8.8 Mar 05

A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Plat
CVE-2021-26960 HIGH
8.8 Mar 05

A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Plat
CVE-2022-37918 HIGH
8.1 Dec 08

Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack
CVE-2022-37917 HIGH
8.1 Dec 08

Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack
CVE-2022-37916 HIGH
8.1 Dec 08

Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack
CVE-2021-25163 HIGH
8.1 Apr 29

A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.1
CVE-2021-25165 HIGH
8.1 Apr 28

A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.1
CVE-2021-25153 HIGH
8.1 Apr 28

A remote SQL injection vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. R

Same weakness CWE-611 – Improper Restriction of XML External Entity Reference

View all
CVE-2019-9670 CRITICAL POC
9.8
CVE-2025-58360 HIGH POC
8.2
CVE-2025-2775 CRITICAL POC
9.3
CVE-2025-2776 CRITICAL POC
9.3
CVE-2017-12629 CRITICAL POC
9.8
CVE-2016-9563 MEDIUM POC
6.5
CVE-2012-3363 CRITICAL POC
9.1
CVE-2016-4264 HIGH POC
8.6

Same technique XXE

View all
CVE-2025-58360 HIGH POC
8.2
CVE-2025-2775 CRITICAL POC
9.3
CVE-2025-2776 CRITICAL POC
9.3
CVE-2017-12629 CRITICAL POC
9.8
CVE-2016-9563 MEDIUM POC
6.5
CVE-2013-5014 HIGH POC
7.5
CVE-2015-0923 MEDIUM POC
5.0
CVE-2014-0644 HIGH POC
7.8

Share

CVE-2021-25164 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy