DeutschShown in its original language — a full translation is planned for a future version.
Aruba EdgeConnect SD-WAN Orchestrator: Mehrere Schwachstellen
view advisory published 2023-08-22
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Aruba EdgeConnect SD-WAN Orchestrator ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, um Informationen offenzulegen und zu manipulieren und um die Kontrolle über das System zu übernehmen.
01
describes (20)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-37440US | medium5.3 | — | ||
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to conduct a server-side request forgery (SS… | ||||
| CVE-2023-37439US | medium6.1 | — | ||
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks agai… | ||||
| CVE-2023-37438US | medium6.5 | — | ||
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks agai… | ||||
| CVE-2023-37437US | medium6.5 | — | ||
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks agai… | ||||
| CVE-2023-37436US | medium6.5 | — | ||
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks agai… | ||||
| CVE-2023-37435US | medium6.5 | — | ||
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks agai… | ||||
| CVE-2023-37434US | high8.1 | — | ||
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks agai… | ||||
| CVE-2023-37433US | high8.1 | — | ||
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks agai… | ||||
| CVE-2023-37432US | high8.1 | — | ||
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks agai… | ||||
| CVE-2023-37431US | high8.1 | — | ||
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks agai… | ||||
| CVE-2023-37430US | high8.1 | — | ||
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks agai… | ||||
| CVE-2023-37429US | high8.1 | — | ||
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks agai… | ||||
| CVE-2023-37428US | high7.2 | — | ||
A vulnerability in the EdgeConnect SD-WAN Orchestrator web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successf… | ||||
| CVE-2023-37427US | high7.2 | — | ||
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to run arbitrary commands on the underlying ho… | ||||
| CVE-2023-37426US | high7.5OT elevated | — | ||
EdgeConnect SD-WAN Orchestrator instances prior to the versions resolved in this advisory were found to have shared static SSH host keys for all installations. This vulnerability c… | ||||
| CVE-2023-37425US | medium6.1 | — | ||
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XS… | ||||
| CVE-2023-37424US | high8.1 | — | ||
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to run arbitrary commands on the underlying… | ||||
| CVE-2023-37423US | medium5.4 | — | ||
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS)… | ||||
| CVE-2023-37422US | medium5.4 | — | ||
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS)… | ||||
| CVE-2023-37421US | medium5.4 | — | ||
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS)… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan