mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-06-07 05:28:59 +00:00
117 lines
3.7 KiB
JSON
117 lines
3.7 KiB
JSON
{
|
|
"id": "CVE-2023-37426",
|
|
"sourceIdentifier": "security-alert@hpe.com",
|
|
"published": "2023-08-22T19:16:37.210",
|
|
"lastModified": "2023-08-30T14:21:34.413",
|
|
"vulnStatus": "Analyzed",
|
|
"cveTags": [],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "EdgeConnect SD-WAN Orchestrator instances prior to the\u00a0versions resolved in this advisory were found to have\u00a0shared static SSH host keys for all installations. This\u00a0vulnerability could allow an attacker to spoof the SSH host\u00a0signature and thereby masquerade as a legitimate Orchestrator\nhost."
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV31": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "NONE",
|
|
"integrityImpact": "HIGH",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 7.5,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"exploitabilityScore": 3.9,
|
|
"impactScore": 3.6
|
|
},
|
|
{
|
|
"source": "security-alert@hpe.com",
|
|
"type": "Secondary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "HIGH",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "HIGH",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 7.4,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"exploitabilityScore": 2.2,
|
|
"impactScore": 5.2
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-798"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"configurations": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "9.0.0",
|
|
"versionEndIncluding": "9.0.5",
|
|
"matchCriteriaId": "5E893AD7-C02C-4608-AF2E-01FDF300DFF0"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "9.1.0",
|
|
"versionEndIncluding": "9.1.7",
|
|
"matchCriteriaId": "A49FCAD2-9EAA-4A38-9416-96C130C6E3CE"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "9.2.0",
|
|
"versionEndIncluding": "9.2.5",
|
|
"matchCriteriaId": "7B72D752-0E1E-4D9F-8DE7-848EA8161402"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "141D0310-AE35-48FA-953A-1F2019370717"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt",
|
|
"source": "security-alert@hpe.com",
|
|
"tags": [
|
|
"Vendor Advisory"
|
|
]
|
|
}
|
|
]
|
|
} |