Lucene search

[email protected]CVE-2022-37914

HistoryOct 28, 2022 - 2:15 a.m.

CVE-2022-37914

2022-10-2802:15:17

[email protected]

web.nvd.nist.gov

aruba

edgeconnect

enterprise orchestrator

vulnerability

web-based interface

unauthorized access

privilege escalation

cve-2022-37914

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.2%

JSON

Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to bypass authentication. Successful exploitation of these vulnerabilities could allow an attacker to gain administrative privileges leading to a complete compromise of the Aruba EdgeConnect Enterprise Orchestrator with versions 9.1.2.40051 and below, 9.0.7.40108 and below, 8.10.23.40009 and below, and any older branches of Orchestrator not specifically mentioned.

Affected configurations

NVD

Node

arubanetworksaruba_edgeconnect_enterprise_orchestratorRange<8.10.23.40009on-premises

arubanetworksaruba_edgeconnect_enterprise_orchestratorRange9.0.0–9.0.7.40108on-premises

arubanetworksaruba_edgeconnect_enterprise_orchestratorRange9.1.0–9.1.3.40197on-premises

Node

arubanetworksaruba_edgeconnect_enterprise_orchestratorRange<8.10.23.40009as-a-service

arubanetworksaruba_edgeconnect_enterprise_orchestratorRange9.0.0–9.0.7.40108as-a-service

arubanetworksaruba_edgeconnect_enterprise_orchestratorRange9.1.0–9.1.3.40197as-a-service

Node

arubanetworksaruba_edgeconnect_enterprise_orchestratorRange<8.10.23.40009sp

arubanetworksaruba_edgeconnect_enterprise_orchestratorRange9.0.0–9.0.7.40108sp

arubanetworksaruba_edgeconnect_enterprise_orchestratorRange9.1.0–9.1.3.40197sp

Node

arubanetworksaruba_edgeconnect_enterprise_orchestratorRange<8.10.23.40009global_enterprise_tenant_orchestrators

arubanetworksaruba_edgeconnect_enterprise_orchestratorRange9.0.0–9.0.7.40108global_enterprise_tenant_orchestrators

arubanetworksaruba_edgeconnect_enterprise_orchestratorRange9.1.0–9.1.3.40197global_enterprise_tenant_orchestrators

CPENameOperatorVersion
arubanetworks:aruba_edgeconnect_enterprise_orchestratorarubanetworks aruba edgeconnect enterprise orchestratorlt8.10.23.40009
arubanetworks:aruba_edgeconnect_enterprise_orchestratorarubanetworks aruba edgeconnect enterprise orchestratorlt9.0.7.40108
arubanetworks:aruba_edgeconnect_enterprise_orchestratorarubanetworks aruba edgeconnect enterprise orchestratorlt9.1.3.40197

CPE	Name	Operator	Version
arubanetworks:aruba_edgeconnect_enterprise_orchestrator	arubanetworks aruba edgeconnect enterprise orchestrator	lt	8.10.23.40009
arubanetworks:aruba_edgeconnect_enterprise_orchestrator	arubanetworks aruba edgeconnect enterprise orchestrator	lt	9.0.7.40108
arubanetworks:aruba_edgeconnect_enterprise_orchestrator	arubanetworks aruba edgeconnect enterprise orchestrator	lt	9.1.3.40197

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators",
    "versions": [
      {
        "version": "Orchestrator 9.1.2.40051 and below",
        "status": "affected"
      },
      {
        "version": "Orchestrator 9.0.7.40108 and below",
        "status": "affected"
      },
      {
        "version": "Orchestrator 8.10.23.40009 and below",
        "status": "affected"
      },
      {
        "version": "Any older branches of Orchestrator not specifically mentioned",
        "status": "affected"
      }
    ]
  }
]

References

www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-015.txt

Social References

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.2%

JSON

Related for CVE-2022-37914

nvd1 prion1 cvelist1