CVE-2023-37423: Authenticated Stored Cross-Site Scripting Vulnerabilities (XSS) in EdgeConnect SD-WAN Orchestrator Web Administration Interface

Q: What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2023-37423.

Q: What is the severity of CVE-2023-37423?

The severity of CVE-2023-37423 is high.

Q: What is the affected software for CVE-2023-37423?

The affected software for CVE-2023-37423 is Arubanetworks Edgeconnect Sd-wan Orchestrator versions 9.0.0 to 9.0.5, 9.1.0 to 9.1.7, 9.2.0 to 9.2.5, and 9.3.0.

Q: What is the CWE number associated with CVE-2023-37423?

The CWE number associated with CVE-2023-37423 is CWE-79.

Q: How do I fix CVE-2023-37423?

To fix CVE-2023-37423, it is recommended to apply the latest security patches provided by Arubanetworks for EdgeConnect SD-WAN Orchestrator.

Published Aug 22, 2023

Updated

Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

Affected Software

4 affected components

Arubanetworks Edgeconnect Sd-wan Orchestrator>=9.0.0<=9.0.5

Arubanetworks Edgeconnect Sd-wan Orchestrator>=9.1.0<=9.1.7

Arubanetworks Edgeconnect Sd-wan Orchestrator>=9.2.0<=9.2.5

Arubanetworks Edgeconnect Sd-wan Orchestrator=9.3.0

Event History

Aug 22, 2023

CVE Published

via MITRE·05:57 PM

Data Sourced

via MITRE·05:57 PM

DescriptionSeverity

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2023-37423.

What is the severity of CVE-2023-37423?

The severity of CVE-2023-37423 is high.

What is the affected software for CVE-2023-37423?