13 results (0.004 seconds)

CVSS: 8.8EPSS: 0%CPEs: 16EXPL: 0

CVE-2022-44535

https://notcve.org/view.php?id=CVE-2022-44535

A vulnerability in the Aruba EdgeConnect Enterprise Orchestrator web-based management interface allows remote low-privileged authenticated users to escalate their privileges to those of an administrative user. A successful exploit could allow an attacker to achieve administrative privilege on the web-management interface leading to complete system compromise in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned. Una vulnerabilidad en la interfaz de administración basada en web de Aruba EdgeConnect Enterprise Orchestrator permite a usuarios remotos autenticados con pocos privilegios escalar sus privilegios a los de un usuario administrativo. Un exploit exitoso podría permitir a un atacante obtener privilegios administrativos en la interfaz de administración web, lo que llevaría a comprometer completamente el sistema en las versiones del software Aruba EdgeConnect Enterprise Orchestration: Aruba EdgeConnect Enterprise Orchestrator (local), Aruba EdgeConnect Enterprise Orchestrator-as- a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP y Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 y versiones anteriores, - Orchestrator 9.1.4.40436 y versiones anteriores, - Orchestrator 9.0.7.40110 y versiones anteriores, - Orchestrator 8.10.23.40015 y versiones anteriores , - Cualquier rama anterior de Orchestrator que no se mencione específicamente. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt •

CVSS: 7.2EPSS: 0%CPEs: 16EXPL: 0

CVE-2022-44534

https://notcve.org/view.php?id=CVE-2022-44534

A vulnerability in the Aruba EdgeConnect Enterprise Orchestrator web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned. Una vulnerabilidad en la interfaz de administración basada en web de Aruba EdgeConnect Enterprise Orchestrator permite a usuarios remotos autenticados ejecutar comandos arbitrarios en el host subyacente. Un exploit exitoso podría permitir a un atacante ejecutar comandos arbitrarios como root en el sistema operativo subyacente, lo que podría comprometer completamente el sistema en las versiones del software Aruba EdgeConnect Enterprise Orchestration: Aruba EdgeConnect Enterprise Orchestrator (local), Aruba EdgeConnect Enterprise Orchestrator-as -a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP y Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 y anteriores, - Orchestrator 9.1.4.40436 y anteriores, - Orchestrator 9.0.7.40110 y anteriores, - Orchestrator 8.10.23.40015 y a continuación, - Cualquier rama anterior de Orchestrator que no se mencione específicamente. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt •

CVSS: 5.4EPSS: 0%CPEs: 16EXPL: 0

CVE-2022-43529

https://notcve.org/view.php?id=CVE-2022-43529

A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an remote attacker to persist a session after a password reset or similar session clearing event. Successful exploitation of this vulnerability could allow an authenticated attacker to remain on the system with the permissions of their current session after the session should be invalidated in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned. Una vulnerabilidad en la interfaz de administración basada en web de Aruba EdgeConnect Enterprise Orchestrator podría permitir que un atacante remoto persista en una sesión después de un restablecimiento de contraseña o un evento similar de borrado de sesión. La explotación exitosa de esta vulnerabilidad podría permitir que un atacante autenticado permanezca en el sistema con los permisos de su sesión actual después de que la sesión se invalide en las versiones del software Aruba EdgeConnect Enterprise Orchestration: Aruba EdgeConnect Enterprise Orchestrator (local), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP y Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 y versiones anteriores, - Orchestrator 9.1.4.40436 y versiones anteriores, - Orchestrator 9.0.7.40110 y versiones anteriores, - Orchestrator 8.10.23.40015 y versiones anteriores: cualquier rama anterior de Orchestrator que no se mencione específicamente. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt • CWE-384: Session Fixation •

CVSS: 6.5EPSS: 0%CPEs: 16EXPL: 0

CVE-2022-43528

https://notcve.org/view.php?id=CVE-2022-43528

Under certain configurations, an attacker can login to Aruba EdgeConnect Enterprise Orchestrator without supplying a multi-factor authentication code. Successful exploitation allows an attacker to login using only a username and password and successfully bypass MFA requirements in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned. En determinadas configuraciones, un atacante puede iniciar sesión en Aruba EdgeConnect Enterprise Orchestrator sin proporcionar un código de autenticación multifactor. La explotación exitosa permite a un atacante iniciar sesión usando solo un nombre de usuario y contraseña y eludir exitosamente los requisitos de MFA en las versiones del software Aruba EdgeConnect Enterprise Orchestration: Aruba EdgeConnect Enterprise Orchestrator (local), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP y Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 y versiones anteriores, - Orchestrator 9.1.4.40436 y versiones anteriores, - Orchestrator 9.0.7.40110 y versiones anteriores, - Orchestrator 8.10.23.40015 y versiones anteriores, - Cualquiera anterior ramas de Orchestrator no mencionadas específicamente. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt •

CVSS: 6.1EPSS: 0%CPEs: 16EXPL: 0

CVE-2022-43527

https://notcve.org/view.php?id=CVE-2022-43527

Multiple vulnerabilities within the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned. Múltiples vulnerabilidades dentro de la interfaz de administración basada en web de Aruba EdgeConnect Enterprise Orchestrator podrían permitir que un atacante remoto lleve a cabo un ataque de cross-site scripting (XSS) reflejado contra un usuario de la interfaz. Un exploit exitoso podría permitir a un atacante ejecutar scriptis arbitrarios en el navegador de la víctima en el contexto de la interfaz afectada en las versiones del software Aruba EdgeConnect Enterprise Orchestration: Aruba EdgeConnect Enterprise Orchestrator (local), Aruba EdgeConnect Enterprise Orchestrator-as -a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP y Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 y anteriores, - Orchestrator 9.1.4.40436 y anteriores, - Orchestrator 9.0.7.40110 y anteriores, - Orchestrator 8.10.23.40015 y a continuación, - Cualquier rama anterior de Orchestrator que no se mencione específicamente. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •