CVE-2021-26966: 
NixOS vulnerability analysis and mitigation

A remote authenticated SQL injection vulnerability was discovered in Aruba AirWave Management Platform versions prior to 8.2.12.0. Multiple vulnerabilities in the API of AirWave could allow an authenticated remote attacker to conduct SQL injection attacks against the AirWave instance (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, and a CVSS v2.0 base score of 5.5 (MEDIUM). The vulnerability is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (NVD).

An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database (NVD).

The vulnerability requires network access and high privileges for exploitation, but has low attack complexity and requires no user interaction. The attack can be conducted remotely by an authenticated user (NVD).

The vulnerability has been fixed in Aruba AirWave Management Platform version 8.2.12.0. Users should upgrade to this version or later to mitigate the vulnerability (NVD).