CVE-2023-37425: Unauthenticated Stored Cross-Site Scripting Vulnerability (XSS) in EdgeConnect SD-WAN Orchestrator Web-Based Management Interface
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-37425?
CVE-2023-37425 is a vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator.
How does CVE-2023-37425 impact Arubanetworks EdgeConnect SD-WAN Orchestrator?
CVE-2023-37425 allows an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface.
What is the severity of CVE-2023-37425?
The severity of CVE-2023-37425 is high with a CVSS score of 6.1.
Which versions of Arubanetworks EdgeConnect SD-WAN Orchestrator are affected by CVE-2023-37425?
Arubanetworks EdgeConnect SD-WAN Orchestrator versions 9.0.0 to 9.0.5, 9.1.0 to 9.1.7, 9.2.0 to 9.2.5, and 9.3.0 are affected by CVE-2023-37425.
How can CVE-2023-37425 be mitigated?
To mitigate CVE-2023-37425, it is recommended to update Arubanetworks EdgeConnect SD-WAN Orchestrator to a version that is not affected by the vulnerability.