Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aruba Ecos | — | PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version:
- Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above
(expected to be available end of September 2023)
For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator:
- EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises)
- EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS)
- EdgeConnect SD-WAN Orchestrator-as-a-Service
- EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators
- EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators
- Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023)
- Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above
- Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above
- EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators
- Service providers must upgrade all tenants to a patched version listed above.
HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone.
Supported branches as of the publication date of this advisory are:
- EdgeConnect SD-WAN Orchestrator 9.3.x
- EdgeConnect SD-WAN Orchestrator 9.2.x
- EdgeConnect SD-WAN Orchestrator 9.1.x
For more information about Aruba's End of Support policy visit:
https://www.arubanetworks.com/support-services/end-of-life/ | Mar 17, 2025 | Aug 22, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub