Medium WID-SEC-2022-2155 13 CVEs

Aruba EdgeConnect: Mehrere Schwachstellen

Published Nov 22, 2022 · Updated Nov 29, 2022 · Revision 3 · de-DE

Vendor: Aruba Product: EdgeConnect Product: EdgeConnect < 8.3.8.0 Product: EdgeConnect < 9.0.8.0 Product: EdgeConnect < 9.1.4.0 Product: EdgeConnect < 9.2.2.0 Product: EdgeConnect Enterprise

Summary

Ein Angreifer kann mehrere Schwachstellen in Aruba EdgeConnect ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, einen Denial of Service zu verursachen, einen Cross Site Scripting Angriff durchzuführen oder Informationen offenzulegen.

Product

Aruba EdgeConnect ist eine SD-WAN-Produktfamilie für Unternehmenskunden.

Vulnerabilities 13

High 7.5

CVE-2022-37919

A vulnerability exists in the API of Aruba EdgeConnect Enterprise. An unauthenticated attacker can exploit this conditi…

Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterprise Software

Nov 30, 2022
High 7.2

CVE-2022-37920

Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbi…

Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterprise Software

Nov 30, 2022
High 7.2

CVE-2022-37921

Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbi…

Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterprise Software

Nov 30, 2022
High 7.2

CVE-2022-37922

Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbi…

Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterprise Software

Nov 30, 2022
High 7.2

CVE-2022-37923

Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbi…

Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterprise Software

Nov 30, 2022
High 7.2

CVE-2022-37924

Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbi…

Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterprise Software

Nov 30, 2022
High 7.2

CVE-2022-43541

Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbi…

Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterprise Software

Nov 30, 2022
High 7.2

CVE-2022-43542

Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbi…

Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterprise Software

Nov 30, 2022
High 7.2

CVE-2022-44533

A vulnerability in the Aruba EdgeConnect Enterprise web management interface allows remote authenticated users to run a…

Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterprise Software

Nov 30, 2022
Medium 6.1

CVE-2022-37925

A vulnerability within the web-based management interface of Aruba EdgeConnect Enterprise could allow a remote attacker…

Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterprise Software

Nov 30, 2022
Medium 5.5

CVE-2022-37926

A vulnerability within the web-based management interface of EdgeConnect Enterprise could allow a remote attacker to co…

Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterprise Software

Nov 30, 2022
Medium 4.9

CVE-2022-43518

An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise web interface. Successful expl…

Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterprise Software

Nov 30, 2022
Medium 4.9

CVE-2022-44532

An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise command line interface. Succes…

Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterprise Software

Nov 30, 2022

Revision history

2022-11-29 #3
Korrektur
2022-11-24 #2
Neue Updates von HP aufgenommen
2022-11-22 #1
Initiale Fassung

References

HPE Security Bulletin
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04389en_us&hprpt_id=ALERT_HPE_3038137&jumpid=em_pom8nu6hj_aid-520066529
Aruba Product Security Advisory vom 2022-11-22
https://www.arubanetworks.com/security-advisory/multiple-vulnerabilities-in-aruba-edgeconnect-enterprise/