A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an remote attacker to persist a session after a password reset or similar session clearing event. Successful exploitation of this vulnerability could allow an authenticated attacker to remain on the system with the permissions of their current session after the session should be invalidated in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.
CVSS Details
- CVSS 3.1 Base Score: 4.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aruba Ecos | — | Upgrade Aruba EdgeConnect Enterprise Orchestrator to one of the following versions with the fixes to resolve all issues noted in the details section.
- - Aruba EdgeConnect Enterprise Orchestrator (on-premises)
- Orchestrator 9.2.2.40291 and above
- Orchestrator 9.1.5.40037 and above
- Aruba EdgeConnect Enterprise Orchestrator-as-a-Service
- TAC will automatically create a support case for Aruba (Silver Peak) hosted Orchestrators to be upgraded.
- Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators
- Service providers must upgrade all tenants to a patched version listed above.
Aruba does not evaluate or patch product versions that have reached their End of Support (EoS) milestone.
Supported versions as of the publication date of this advisory are:
- Aruba EdgeConnect Enterprise Orchestrator 9.2.x
- Aruba EdgeConnect Enterprise Orchestrator 9.1.x
Note: Aruba EdgeConnect Enterprise Orchestrator releases 8.10.x and 9.0.x have been declared End of Maintenance (EoM). This is earlier than previously published because of challenges associated with porting the security fixes covered in this advisory without introducing undue risks.
For more information about Aruba's End of Support policy visit:
https://www.arubanetworks.com/support-services/end-of-life/ | Mar 17, 2025 | Dec 13, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub