PT-2023-14497 · Aruba · Aruba Edgeconnect Enterprise Orchestrator

CVE-2022-44535 · Publicado 2023-01-03 · Atualizado 2023-01-11

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Aruba EdgeConnect Enterprise Orchestrator versions 9.2.1.40179 and below Aruba EdgeConnect Enterprise Orchestrator versions 9.1.4.40436 and below Aruba EdgeConnect Enterprise Orchestrator versions 9.0.7.40110 and below Aruba EdgeConnect Enterprise Orchestrator versions 8.10.23.40015 and below

Description A vulnerability in the Aruba EdgeConnect Enterprise Orchestrator web-based management interface allows remote low-privileged authenticated users to escalate their privileges to those of an administrative user. A successful exploit could allow an attacker to achieve administrative privilege on the web-management interface leading to complete system compromise.

Recommendations For versions 9.2.1.40179 and below, update to a version above 9.2.1.40179 to resolve the issue. For versions 9.1.4.40436 and below, update to a version above 9.1.4.40436 to resolve the issue. For versions 9.0.7.40110 and below, update to a version above 9.0.7.40110 to resolve the issue. For versions 8.10.23.40015 and below, update to a version above 8.10.23.40015 to resolve the issue. As a temporary workaround, consider restricting access to the web-based management interface until a patch is available.

Correção

Identificadores relacionados

CVE-2022-44535

Produtos afetados

Aruba Edgeconnect Enterprise Orchestrator

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-44535 · Nota de Segurança
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt · Aviso do Fabricante
• https://t.me/cibsecurity/55947 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-44535 · Aviso do Fabricante