CVE-2022-43528

Katalog CVE

CVSS 6.5 · Medium EPSS 0,37%

Kerentanan Improper Authentication pada arubanetworks aruba edgeconnect enterprise orchestrator. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Under certain configurations, an attacker can login to Aruba EdgeConnect Enterprise Orchestrator without supplying a multi-factor authentication code. Successful exploitation allows an attacker to login using only a username and password and successfully bypass MFA requirements in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.

Rincian

Terbit di NVD

5 Januari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt mitigasi · advisory vendor