PT-2022-26954 · Aruba · Aruba Edgeconnect Enterprise

Published 2022-11-30 · Updated 2022-12-15 · CVE-2022-43518

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Aruba EdgeConnect Enterprise Software versions prior to ECOS 9.2.1.0 Aruba EdgeConnect Enterprise Software versions prior to ECOS 9.1.3.0 Aruba EdgeConnect Enterprise Software versions prior to ECOS 9.0.7.0 Aruba EdgeConnect Enterprise Software versions prior to ECOS 8.3.7.1

Description An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise web interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files on the underlying operating system, including sensitive system files.

Recommendations For versions prior to ECOS 9.2.1.0, update to a version above ECOS 9.2.1.0 to resolve the issue. For versions prior to ECOS 9.1.3.0, update to a version above ECOS 9.1.3.0 to resolve the issue. For versions prior to ECOS 9.0.7.0, update to a version above ECOS 9.0.7.0 to resolve the issue. For versions prior to ECOS 8.3.7.1, update to a version above ECOS 8.3.7.1 to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-43518

Affected Products

Aruba Edgeconnect Enterprise

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-43518 · Security Note
• https://osv.dev/vulnerability/CVE-2022-43518 · Vendor Advisory
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2022-018.txt · Vendor Advisory
• https://t.me/cvenotify/39961 · Telegram Post
• https://t.me/cibsecurity/54311 · Telegram Post