DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Aruba EdgeConnect SD-WAN Orchestrator: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2023-08-22
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Aruba EdgeConnect SD-WAN Orchestrator ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, um Informationen offenzulegen und zu manipulieren und um die Kontrolle über das System zu übernehmen.
01
beschreibt (20)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-37440US | medium5.3 | — | ||
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to conduct a server-side request forgery (SS… | ||||
| CVE-2023-37439US | medium6.1 | — | ||
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks agai… | ||||
| CVE-2023-37438US | medium6.5 | — | ||
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks agai… | ||||
| CVE-2023-37437US | medium6.5 | — | ||
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks agai… | ||||
| CVE-2023-37436US | medium6.5 | — | ||
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks agai… | ||||
| CVE-2023-37435US | medium6.5 | — | ||
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks agai… | ||||
| CVE-2023-37434US | high8.1 | — | ||
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks agai… | ||||
| CVE-2023-37433US | high8.1 | — | ||
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks agai… | ||||
| CVE-2023-37432US | high8.1 | — | ||
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks agai… | ||||
| CVE-2023-37431US | high8.1 | — | ||
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks agai… | ||||
| CVE-2023-37430US | high8.1 | — | ||
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks agai… | ||||
| CVE-2023-37429US | high8.1 | — | ||
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks agai… | ||||
| CVE-2023-37428US | high7.2 | — | ||
A vulnerability in the EdgeConnect SD-WAN Orchestrator web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successf… | ||||
| CVE-2023-37427US | high7.2 | — | ||
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to run arbitrary commands on the underlying ho… | ||||
| CVE-2023-37426US | high7.5OT erhöht | — | ||
EdgeConnect SD-WAN Orchestrator instances prior to the versions resolved in this advisory were found to have shared static SSH host keys for all installations. This vulnerability c… | ||||
| CVE-2023-37425US | medium6.1 | — | ||
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XS… | ||||
| CVE-2023-37424US | high8.1 | — | ||
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to run arbitrary commands on the underlying… | ||||
| CVE-2023-37423US | medium5.4 | — | ||
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS)… | ||||
| CVE-2023-37422US | medium5.4 | — | ||
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS)… | ||||
| CVE-2023-37421US | medium5.4 | — | ||
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS)… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan