Vulnerability Details : CVE-2022-43521
Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the Aruba EdgeConnect Enterprise Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the Aruba EdgeConnect Enterprise Orchestrator host in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.
Vulnerability category: Sql Injection
Products affected by CVE-2022-43521
- Arubanetworks » Aruba Edgeconnect Enterprise Orchestrator » As-a-service EditionVersions from including (>=) 9.0.0 and up to, including, (<=) 9.0.7.40110cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:as-a-service:*:*:*
- Arubanetworks » Aruba Edgeconnect Enterprise Orchestrator » Global Enterprise Tenant Orchestrators EditionVersions from including (>=) 9.0.0 and up to, including, (<=) 9.0.7.40110cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:global_enterprise_tenant_orchestrators:*:*:*
- Arubanetworks » Aruba Edgeconnect Enterprise Orchestrator » SP EditionVersions up to, including, (<=) 8.10.23.40015cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:sp:*:*:*
- Arubanetworks » Aruba Edgeconnect Enterprise Orchestrator » On-premises EditionVersions from including (>=) 9.2.0 and up to, including, (<=) 9.2.1.40179cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:on-premises:*:*:*
- Arubanetworks » Aruba Edgeconnect Enterprise Orchestrator » As-a-service EditionVersions from including (>=) 9.1.0 and up to, including, (<=) 9.1.4.40436cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:as-a-service:*:*:*
- Arubanetworks » Aruba Edgeconnect Enterprise Orchestrator » SP EditionVersions from including (>=) 9.1.0 and up to, including, (<=) 9.1.4.40436cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:sp:*:*:*
- Arubanetworks » Aruba Edgeconnect Enterprise Orchestrator » Global Enterprise Tenant Orchestrators EditionVersions from including (>=) 9.2.0 and up to, including, (<=) 9.2.1.40179cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:global_enterprise_tenant_orchestrators:*:*:*
- Arubanetworks » Aruba Edgeconnect Enterprise Orchestrator » As-a-service EditionVersions from including (>=) 9.2.0 and up to, including, (<=) 9.2.1.40179cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:as-a-service:*:*:*
- Arubanetworks » Aruba Edgeconnect Enterprise Orchestrator » As-a-service EditionVersions up to, including, (<=) 8.10.23.40015cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:as-a-service:*:*:*
- Arubanetworks » Aruba Edgeconnect Enterprise Orchestrator » On-premises EditionVersions from including (>=) 9.0.0 and up to, including, (<=) 9.0.7.40110cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:on-premises:*:*:*
- Arubanetworks » Aruba Edgeconnect Enterprise Orchestrator » On-premises EditionVersions up to, including, (<=) 8.10.23.40015cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:on-premises:*:*:*
- Arubanetworks » Aruba Edgeconnect Enterprise Orchestrator » On-premises EditionVersions from including (>=) 9.1.0 and up to, including, (<=) 9.1.4.40436cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:on-premises:*:*:*
- Arubanetworks » Aruba Edgeconnect Enterprise Orchestrator » SP EditionVersions from including (>=) 9.0.0 and up to, including, (<=) 9.0.7.40110cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:sp:*:*:*
- Arubanetworks » Aruba Edgeconnect Enterprise Orchestrator » SP EditionVersions from including (>=) 9.2.0 and up to, including, (<=) 9.2.1.40179cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:sp:*:*:*
- Arubanetworks » Aruba Edgeconnect Enterprise Orchestrator » Global Enterprise Tenant Orchestrators EditionVersions from including (>=) 9.1.0 and up to, including, (<=) 9.1.4.40436cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:global_enterprise_tenant_orchestrators:*:*:*
- Arubanetworks » Aruba Edgeconnect Enterprise Orchestrator » Global Enterprise Tenant Orchestrators EditionVersions up to, including, (<=) 8.10.23.40015cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:global_enterprise_tenant_orchestrators:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-43521
0.10%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 42 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-43521
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST | |
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
Hewlett Packard Enterprise (HPE) |
CWE ids for CVE-2022-43521
-
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-43521
-
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt
Mitigation;Vendor Advisory
Jump to