CVE-2021-26960: 
NixOS vulnerability analysis and mitigation

A remote unauthenticated cross-site request forgery (CSRF) vulnerability was discovered in Aruba AirWave Management Platform versions prior to 8.2.12.0. The vulnerability was assigned CVE-2021-26960 and was published on March 5, 2021 (NVD).

The vulnerability exists in the AirWave web-based management interface, allowing an unauthenticated remote attacker to conduct CSRF attacks against vulnerable systems. The vulnerability has been assigned a CVSS v3.1 Base Score of 8.8 (HIGH) and a CVSS v2.0 Base Score of 6.8 (MEDIUM). The vulnerability is tracked under CWE-352 (Cross-Site Request Forgery) (NVD).

A successful exploitation of this vulnerability would allow an attacker to persuade an authorized user to follow a malicious link, resulting in arbitrary actions being carried out with the privilege level of the targeted user (NVD).

The vulnerability requires an attacker to craft a malicious link and convince an authorized user to click on it. The attack complexity is considered Low according to the CVSS metrics, and no authentication is required for the attacker to initiate the exploit (NVD).

The vulnerability has been fixed in Aruba AirWave Management Platform version 8.2.12.0. Users are advised to upgrade to this version or later to mitigate the vulnerability (NVD).