Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aruba Ecos | — | PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version:
- Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above
(expected to be available end of September 2023)
For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator:
- EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises)
- EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS)
- EdgeConnect SD-WAN Orchestrator-as-a-Service
- EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators
- EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators
- Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023)
- Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above
- Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above
- EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators
- Service providers must upgrade all tenants to a patched version listed above.
HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone.
Supported branches as of the publication date of this advisory are:
- EdgeConnect SD-WAN Orchestrator 9.3.x
- EdgeConnect SD-WAN Orchestrator 9.2.x
- EdgeConnect SD-WAN Orchestrator 9.1.x
For more information about Aruba's End of Support policy visit:
https://www.arubanetworks.com/support-services/end-of-life/ | Mar 17, 2025 | Aug 22, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub