A vulnerability exists in the Aruba EdgeConnect Enterprise web management interface that allows remote authenticated users to issue arbitrary URL requests from the Aruba EdgeConnect Enterprise instance. The impact of this vulnerability is limited to a subset of URLs which can result in the possible disclosure of data due to the network position of the Aruba EdgeConnect Enterprise instance.
CVSS Details
- CVSS 3.1 Base Score: 4.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aruba Ecos | — | Upgrade Aruba EdgeConnect Enterprise to one of the following versions to resolve all issues noted in the details section. - Aruba EdgeConnect Enterprise - ECOS 9.3.x.x: 9.3.0.0 and above - ECOS 9.2.x.x: 9.2.4.0 and above - ECOS 9.1.x.x: 9.1.6.0 and above - ECOS 9.0.x.x: 9.0.9.0 and above. Aruba does not evaluate or patch product versions that have reached their End of Support (EoS) milestone. Supported versions as of the publication date of this advisory are: - Aruba EdgeConnect Enterprise 9.3.x.x - Aruba EdgeConnect Enterprise 9.2.x.x - Aruba EdgeConnect Enterprise 9.1.x.x - Aruba EdgeConnect Enterprise 9.0.x.x Note: EdgeConnect release 9.0 reaches end of maintenance as of June 20, 2023. ECOS 9.0.9.0 will be the last release in the 9.0 release stream. For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/ | Mar 17, 2025 | May 23, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub