Lucene search

[email protected]CVE-2022-37925

HistoryDec 12, 2022 - 1:15 p.m.

CVE-2022-37925

2022-12-1213:15:13

CWE-79

[email protected]

web.nvd.nist.gov

cve-2022-37925

aruba

edgeconnect

enterprise

web-based management

interface

vulnerability

xss

attack

remote attacker

security

ecos

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

42.7%

JSON

A vulnerability within the web-based management interface of Aruba EdgeConnect Enterprise could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the affected interface in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; ECOS 9.1.3.0 and below; ECOS 9.0.7.0 and below; ECOS 8.3.7.1 and below.

Affected configurations

NVD

Node

arubanetworksedgeconnect_enterpriseRange8.3.1.0–8.3.7.1

arubanetworksedgeconnect_enterpriseRange9.0.0.0–9.0.7.0

arubanetworksedgeconnect_enterpriseRange9.1.0.0–9.1.3.0

arubanetworksedgeconnect_enterpriseRange9.2.0.0–9.2.1.0

CPENameOperatorVersion
arubanetworks:edgeconnect_enterprisearubanetworks edgeconnect enterprisele8.3.7.1
arubanetworks:edgeconnect_enterprisearubanetworks edgeconnect enterprisele9.0.7.0
arubanetworks:edgeconnect_enterprisearubanetworks edgeconnect enterprisele9.1.3.0
arubanetworks:edgeconnect_enterprisearubanetworks edgeconnect enterprisele9.2.1.0

CPE	Name	Operator	Version
arubanetworks:edgeconnect_enterprise	arubanetworks edgeconnect enterprise	le	8.3.7.1
arubanetworks:edgeconnect_enterprise	arubanetworks edgeconnect enterprise	le	9.0.7.0
arubanetworks:edgeconnect_enterprise	arubanetworks edgeconnect enterprise	le	9.1.3.0
arubanetworks:edgeconnect_enterprise	arubanetworks edgeconnect enterprise	le	9.2.1.0

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Aruba EdgeConnect Enterprise Software",
    "vendor": "Hewlett Packard Enterprise (HPE)",
    "versions": [
      {
        "status": "affected",
        "version": "ECOS 9.2.1.0 and below; ECOS 9.1.3.0 and below; ECOS 9.0.7.0 and below; ECOS 8.3.7.1 and below;"
      }
    ]
  }
]

References

www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-018.txt

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

42.7%

JSON

Related for CVE-2022-37925

prion1 nvd1 cvelist1