CVE-2023-37440: Authenticated Server-Side Request Forgery (SSRF) Leading to Information Disclosure
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to conduct a server-side request forgery (SSRF) attack. A successful exploit allows an attacker to enumerate information about the internal structure of the EdgeConnect SD-WAN Orchestrator host leading to potential disclosure of sensitive information.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-37440?
CVE-2023-37440 is a vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator that allows an unauthenticated remote attacker to conduct a server-side request forgery (SSRF) attack.
What is the severity of CVE-2023-37440?
The severity of CVE-2023-37440 is medium with a CVSS severity score of 5.5.
How can an attacker exploit CVE-2023-37440?
An attacker can exploit CVE-2023-37440 by sending crafted requests to the web-based management interface of EdgeConnect SD-WAN Orchestrator.
What is the affected software by CVE-2023-37440?
The affected software by CVE-2023-37440 is Arubanetworks Edgeconnect Sd-wan Orchestrator version up to 9.3.1.
Is there a fix for CVE-2023-37440?
Yes, upgrading to a version higher than 9.3.1 of Arubanetworks Edgeconnect Sd-wan Orchestrator resolves the vulnerability.