2023-04-24 12:24:31 +02:00
{
"id" : "CVE-2022-44535" ,
"sourceIdentifier" : "security-alert@hpe.com" ,
"published" : "2023-01-05T07:15:14.437" ,
2023-11-07 21:03:21 +00:00
"lastModified" : "2023-11-07T03:54:17.973" ,
"vulnStatus" : "Modified" ,
2023-04-24 12:24:31 +02:00
"descriptions" : [
{
"lang" : "en" ,
2023-11-07 21:03:21 +00:00
"value" : "A vulnerability in the Aruba EdgeConnect Enterprise Orchestrator web-based management interface allows remote low-privileged authenticated users to escalate their privileges to those of an administrative user. A successful exploit could allow an attacker to achieve administrative privilege on the web-management interface leading to complete system compromise in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.\n\n"
2023-04-24 12:24:31 +02:00
}
] ,
"metrics" : {
"cvssMetricV31" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "LOW" ,
"userInteraction" : "NONE" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "HIGH" ,
"integrityImpact" : "HIGH" ,
"availabilityImpact" : "HIGH" ,
"baseScore" : 8.8 ,
"baseSeverity" : "HIGH"
} ,
"exploitabilityScore" : 2.8 ,
"impactScore" : 5.9
} ,
{
2023-11-07 21:03:21 +00:00
"source" : "eb103674-0d28-4225-80f8-39fb86215de0" ,
2023-04-24 12:24:31 +02:00
"type" : "Secondary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "LOW" ,
"userInteraction" : "NONE" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "HIGH" ,
"integrityImpact" : "HIGH" ,
"availabilityImpact" : "HIGH" ,
"baseScore" : 8.8 ,
"baseSeverity" : "HIGH"
} ,
"exploitabilityScore" : 2.8 ,
"impactScore" : 5.9
}
]
} ,
"weaknesses" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "NVD-CWE-noinfo"
}
]
}
] ,
"configurations" : [
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:on-premises:*:*:*" ,
"versionEndIncluding" : "8.10.23.40015" ,
"matchCriteriaId" : "C105433F-3477-4632-A192-672219AF0CEA"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:on-premises:*:*:*" ,
"versionStartIncluding" : "9.0.0" ,
"versionEndIncluding" : "9.0.7.40110" ,
"matchCriteriaId" : "BB3793BE-F70F-4495-9911-5900FD0C1BCB"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:on-premises:*:*:*" ,
"versionStartIncluding" : "9.1.0" ,
"versionEndIncluding" : "9.1.4.40436" ,
"matchCriteriaId" : "C58AD722-2552-4D6B-A390-DDCEBE5F3726"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:on-premises:*:*:*" ,
"versionStartIncluding" : "9.2.0" ,
"versionEndIncluding" : "9.2.1.40179" ,
"matchCriteriaId" : "541AC697-70DD-4832-8DDE-D1EA38A1A880"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:as-a-service:*:*:*" ,
"versionEndIncluding" : "8.10.23.40015" ,
"matchCriteriaId" : "B2F6BAE3-54F7-45EB-984C-0B08832867A6"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:as-a-service:*:*:*" ,
"versionStartIncluding" : "9.0.0" ,
"versionEndIncluding" : "9.0.7.40110" ,
"matchCriteriaId" : "1003D598-16E2-4574-B3BB-D1466EA9ECFA"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:as-a-service:*:*:*" ,
"versionStartIncluding" : "9.1.0" ,
"versionEndIncluding" : "9.1.4.40436" ,
"matchCriteriaId" : "84E2C92F-3A9C-4072-9B1D-641C465933BD"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:as-a-service:*:*:*" ,
"versionStartIncluding" : "9.2.0" ,
"versionEndIncluding" : "9.2.1.40179" ,
"matchCriteriaId" : "AB3DB912-1729-498E-8488-6BC653612C6F"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:global_enterprise_tenant_orchestrators:*:*:*" ,
"versionEndIncluding" : "8.10.23.40015" ,
"matchCriteriaId" : "FB9D2623-6A8D-44D7-91BD-ED949A038093"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:global_enterprise_tenant_orchestrators:*:*:*" ,
"versionStartIncluding" : "9.0.0" ,
"versionEndIncluding" : "9.0.7.40110" ,
"matchCriteriaId" : "4D27B112-874D-409F-88E4-1ECAE1C6C12E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:global_enterprise_tenant_orchestrators:*:*:*" ,
"versionStartIncluding" : "9.1.0" ,
"versionEndIncluding" : "9.1.4.40436" ,
"matchCriteriaId" : "FB5C1812-258C-4160-AA43-A2055356C74B"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:global_enterprise_tenant_orchestrators:*:*:*" ,
"versionStartIncluding" : "9.2.0" ,
"versionEndIncluding" : "9.2.1.40179" ,
"matchCriteriaId" : "A5211AA6-5C28-4613-BD9A-96A644F84D03"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:sp:*:*:*" ,
"versionEndIncluding" : "8.10.23.40015" ,
"matchCriteriaId" : "4F8E179A-99CE-4AA3-98F6-D7EC673789A1"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:sp:*:*:*" ,
"versionStartIncluding" : "9.0.0" ,
"versionEndIncluding" : "9.0.7.40110" ,
"matchCriteriaId" : "CCE867DF-E468-460D-B016-5AE6929512FD"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:sp:*:*:*" ,
"versionStartIncluding" : "9.1.0" ,
"versionEndIncluding" : "9.1.4.40436" ,
"matchCriteriaId" : "9213A4AD-3468-498C-8462-36BBF49FC7CA"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:sp:*:*:*" ,
"versionStartIncluding" : "9.2.0" ,
"versionEndIncluding" : "9.2.1.40179" ,
"matchCriteriaId" : "E23CDE96-A543-4075-B5CB-60EC87F5A4A3"
}
]
}
]
}
] ,
"references" : [
{
"url" : "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt" ,
"source" : "security-alert@hpe.com" ,
"tags" : [
"Mitigation" ,
"Vendor Advisory"
]
}
]
}
