CVE-2022-43529
First published: Tue Jan 03 2023(Updated: )
A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an remote attacker to persist a session after a password reset or similar session clearing event. Successful exploitation of this vulnerability could allow an authenticated attacker to remain on the system with the permissions of their current session after the session should be invalidated in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.
Credit: security-alert@hpe.com security-alert@hpe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Arubanetworks Aruba Edgeconnect Enterprise Orchestrator | <=8.10.23.40015 | |
| Arubanetworks Aruba Edgeconnect Enterprise Orchestrator | >=9.0.0<=9.0.7.40110 | |
| Arubanetworks Aruba Edgeconnect Enterprise Orchestrator | >=9.1.0<=9.1.4.40436 | |
| Arubanetworks Aruba Edgeconnect Enterprise Orchestrator | >=9.2.0<=9.2.1.40179 | |
| Arubanetworks Aruba Edgeconnect Enterprise Orchestrator | <=8.10.23.40015 | |
| Arubanetworks Aruba Edgeconnect Enterprise Orchestrator | >=9.0.0<=9.0.7.40110 | |
| Arubanetworks Aruba Edgeconnect Enterprise Orchestrator | >=9.1.0<=9.1.4.40436 | |
| Arubanetworks Aruba Edgeconnect Enterprise Orchestrator | >=9.2.0<=9.2.1.40179 | |
| Arubanetworks Aruba Edgeconnect Enterprise Orchestrator | <=8.10.23.40015 | |
| Arubanetworks Aruba Edgeconnect Enterprise Orchestrator | >=9.0.0<=9.0.7.40110 | |
| Arubanetworks Aruba Edgeconnect Enterprise Orchestrator | >=9.1.0<=9.1.4.40436 | |
| Arubanetworks Aruba Edgeconnect Enterprise Orchestrator | >=9.2.0<=9.2.1.40179 | |
| Arubanetworks Aruba Edgeconnect Enterprise Orchestrator | <=8.10.23.40015 | |
| Arubanetworks Aruba Edgeconnect Enterprise Orchestrator | >=9.0.0<=9.0.7.40110 | |
| Arubanetworks Aruba Edgeconnect Enterprise Orchestrator | >=9.1.0<=9.1.4.40436 | |
| Arubanetworks Aruba Edgeconnect Enterprise Orchestrator | >=9.2.0<=9.2.1.40179 | |
| <=8.10.23.40015 | ||
| >=9.0.0<=9.0.7.40110 | ||
| >=9.1.0<=9.1.4.40436 | ||
| >=9.2.0<=9.2.1.40179 | ||
| <=8.10.23.40015 | ||
| >=9.0.0<=9.0.7.40110 | ||
| >=9.1.0<=9.1.4.40436 | ||
| >=9.2.0<=9.2.1.40179 | ||
| <=8.10.23.40015 | ||
| >=9.0.0<=9.0.7.40110 | ||
| >=9.1.0<=9.1.4.40436 | ||
| >=9.2.0<=9.2.1.40179 | ||
| <=8.10.23.40015 | ||
| >=9.0.0<=9.0.7.40110 | ||
| >=9.1.0<=9.1.4.40436 | ||
| >=9.2.0<=9.2.1.40179 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2022-43529?
CVE-2022-43529 is a vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator that could allow a remote attacker to persist a session after a password reset or similar event.
What is the severity of CVE-2022-43529?
CVE-2022-43529 has a severity keyword of 'medium' and a severity value of 5.4.
How can this vulnerability be exploited?
This vulnerability could be exploited by an authenticated attacker to remain in a session even after a password reset or similar event.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/severity
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/author
- agent/softwarecombine
- agent/event
- agent/tags
- agent/source
- vendor/arubanetworks
- canonical/arubanetworks aruba edgeconnect enterprise orchestrator
- version/arubanetworks aruba edgeconnect enterprise orchestrator/8.10.23.40015
- version/arubanetworks aruba edgeconnect enterprise orchestrator/9.0.0
- version/arubanetworks aruba edgeconnect enterprise orchestrator/9.0.7.40110
- version/arubanetworks aruba edgeconnect enterprise orchestrator/9.1.0
- version/arubanetworks aruba edgeconnect enterprise orchestrator/9.1.4.40436
- version/arubanetworks aruba edgeconnect enterprise orchestrator/9.2.0
- version/arubanetworks aruba edgeconnect enterprise orchestrator/9.2.1.40179