A vulnerability within the web-based management interface of EdgeConnect Enterprise could allow a remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface by uploading a specially crafted file. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; ECOS 9.1.3.0 and below; ECOS 9.0.7.0 and below; ECOS 8.3.7.1 and below.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aruba Ecos | — | Upgrade Aruba EdgeConnect Enterprise to one of the following versions to resolve all issues noted in the details section.
- Aruba EdgeConnect Enterprise
- ECOS 9.2.2.0 and above
- ECOS 9.1.4.0 and above
- ECOS 9.0.8.0 and above
- ECOS 8.3.8.0 and above
Aruba does not evaluate or patch product versions that have reached their End of Support (EoS) milestone.
Supported versions as of the publication date of this advisory are:
- Aruba EdgeConnect Enterprise 9.2.x
- Aruba EdgeConnect Enterprise 9.1.x
- Aruba EdgeConnect Enterprise 9.0.x
- Aruba EdgeConnect Enterprise 8.3.x
For more information about Aruba's End of Support policy visit:
https://www.arubanetworks.com/support-services/end-of-life/ | Mar 17, 2025 | Nov 22, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub