High severity · published Jan 5, 2023
CVE-2022-43522
Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remote attacker to conduct SQL injection…
8.8
CVSS
1%
EPSS
No
On KEV
Description
Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the Aruba EdgeConnect Enterprise Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the Aruba EdgeConnect Enterprise Orchestrator host in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
Aruba Edgeconnect Enterprise Orchestrator · Arubanetworks
through 8.10.23.40015; 9.0.0 through 9.0.7.40110; 9.1.0 through 9.1.4.40436; 9.2.0 through 9.2.1.40179; through 8.10.23.40015; 9.0.0 through 9.0.7.40110; +10 more · source: NVD
Affected product
AE
Aruba Edgeconnect Enterprise Orchestrator
Arubanetworks
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-43522
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-43522
Mitigation
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt
More from Aruba Edgeconnect Enterprise Orchestrator
9.8
CVE-2022-37913
Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to bypass authentication
9.8
CVE-2022-37914
Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to bypass authentication
9.8
CVE-2022-37915
A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to run arbitrary commands on the…
8.8
CVE-2022-44535
A vulnerability in the Aruba EdgeConnect Enterprise Orchestrator web-based management interface allows remote low-privileged authenticated users to escalate their privileges to…
8.8
CVE-2022-43523
Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remote attacker to conduct SQL injection…