CVE-2023-37421: Authenticated Stored Cross-Site Scripting Vulnerabilities (XSS) in EdgeConnect SD-WAN Orchestrator Web Administration Interface
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-37421?
CVE-2023-37421 refers to vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator that could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface.
How severe is CVE-2023-37421?
CVE-2023-37421 has a severity rating of 5.4, which is considered high.
Which software versions are affected by CVE-2023-37421?
Arubanetworks Edgeconnect Sd-wan Orchestrator versions 9.0.0 to 9.0.5, 9.1.0 to 9.1.7, 9.2.0 to 9.2.5, and 9.3.0 are affected by CVE-2023-37421.
What is the CWE ID for CVE-2023-37421?
The CWE ID for CVE-2023-37421 is 79.
How can I fix CVE-2023-37421?
To fix CVE-2023-37421, it is recommended to update Arubanetworks Edgeconnect Sd-wan Orchestrator to a version that is not affected by the vulnerability.