PT-2022-24157 · Aruba · Aruba Edgeconnect Enterprise

Published 2022-11-30 · Updated 2025-04-24 · CVE-2022-37926

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Aruba EdgeConnect Enterprise Software versions prior to ECOS 9.2.1.0 Aruba EdgeConnect Enterprise Software versions prior to ECOS 9.1.3.0 Aruba EdgeConnect Enterprise Software versions prior to ECOS 9.0.7.0 Aruba EdgeConnect Enterprise Software versions prior to ECOS 8.3.7.1

Description A vulnerability within the web-based management interface of EdgeConnect Enterprise could allow a remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface by uploading a specially crafted file. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

Recommendations For versions prior to ECOS 9.2.1.0, update to a version above ECOS 9.2.1.0 to resolve the issue. For versions prior to ECOS 9.1.3.0, update to a version above ECOS 9.1.3.0 to resolve the issue. For versions prior to ECOS 9.0.7.0, update to a version above ECOS 9.0.7.0 to resolve the issue. For versions prior to ECOS 8.3.7.1, update to a version above ECOS 8.3.7.1 to resolve the issue. As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-37926

Affected Products

Aruba Edgeconnect Enterprise

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-37926 · Security Note
• https://osv.dev/vulnerability/CVE-2022-37926 · Vendor Advisory
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2022-018.txt · Vendor Advisory
• https://t.me/cvenotify/119734 · Telegram Post
• https://t.me/cibsecurity/54302 · Telegram Post