CVE-2022-43528

EPSS 0.08%
Published 05.01.2023 07:15:12
Last modified 10.04.2025 17:15:35
Source security-alert@hpe.com
Teams watchlist Login
Open Login

Under certain configurations, an attacker can login to Aruba EdgeConnect Enterprise Orchestrator without supplying a multi-factor authentication code. Successful exploitation allows an attacker to login using only a username and password and successfully bypass MFA requirements in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Arubanetworks ≫ Aruba Edgeconnect Enterprise Orchestrator SwEditionon-premises Version <= 8.10.23.40015

Arubanetworks ≫ Aruba Edgeconnect Enterprise Orchestrator SwEditionon-premises Version >= 9.0.0 <= 9.0.7.40110

Arubanetworks ≫ Aruba Edgeconnect Enterprise Orchestrator SwEditionon-premises Version >= 9.1.0 <= 9.1.4.40436

Arubanetworks ≫ Aruba Edgeconnect Enterprise Orchestrator SwEditionon-premises Version >= 9.2.0 <= 9.2.1.40179

Arubanetworks ≫ Aruba Edgeconnect Enterprise Orchestrator SwEditionas-a-service Version <= 8.10.23.40015

Arubanetworks ≫ Aruba Edgeconnect Enterprise Orchestrator SwEditionas-a-service Version >= 9.0.0 <= 9.0.7.40110

Arubanetworks ≫ Aruba Edgeconnect Enterprise Orchestrator SwEditionas-a-service Version >= 9.1.0 <= 9.1.4.40436

Arubanetworks ≫ Aruba Edgeconnect Enterprise Orchestrator SwEditionas-a-service Version >= 9.2.0 <= 9.2.1.40179

Arubanetworks ≫ Aruba Edgeconnect Enterprise Orchestrator SwEditionglobal_enterprise_tenant_orchestrators Version <= 8.10.23.40015

Arubanetworks ≫ Aruba Edgeconnect Enterprise Orchestrator SwEditionglobal_enterprise_tenant_orchestrators Version >= 9.0.0 <= 9.0.7.40110

Arubanetworks ≫ Aruba Edgeconnect Enterprise Orchestrator SwEditionglobal_enterprise_tenant_orchestrators Version >= 9.1.0 <= 9.1.4.40436

Arubanetworks ≫ Aruba Edgeconnect Enterprise Orchestrator SwEditionglobal_enterprise_tenant_orchestrators Version >= 9.2.0 <= 9.2.1.40179

Arubanetworks ≫ Aruba Edgeconnect Enterprise Orchestrator SwEditionsp Version <= 8.10.23.40015

Arubanetworks ≫ Aruba Edgeconnect Enterprise Orchestrator SwEditionsp Version >= 9.0.0 <= 9.0.7.40110

Arubanetworks ≫ Aruba Edgeconnect Enterprise Orchestrator SwEditionsp Version >= 9.1.0 <= 9.1.4.40436

Arubanetworks ≫ Aruba Edgeconnect Enterprise Orchestrator SwEditionsp Version >= 9.2.0 <= 9.2.1.40179

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.08%	0.242

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	6.5	3.9	2.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
security-alert@hpe.com	4.8	2.2	2.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt

Vendor Advisory

Mitigation

https://nvd.nist.gov/vuln/detail/CVE-2022-43528

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-43528

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-43528

EUVD