Aruba Security Updates 14 December 2022

The severity of the addressed vulnerabilities could allow the remote attacker to execute code, obtain information, and bypass security controls.

Samples of the addressed vulnerabilities:

1- Privilege Escalation Aruba EdgeConnect Enterprise Orchestrator Web-based Management Interface (CVE-2022-44535):

• CVSS: 8.8

• Attack Vector: Network

• Attack Complexity: Low

• Privileges Required: Low

• User Interaction: None

• Consequences: Gain Privilege

2- Authenticated SQL Injection in Aruba EdgeConnect Enterprise Orchestrator Web-based Management Interface (CVE-2022-43519):

• CVSS: 8.8

• Attack Vector: Network

• Attack Complexity: Low

• Privileges Required: Low

• User Interaction: None

• Consequences: Gain Access

Affected Products:

• Aruba EdgeConnect Enterprise Orchestrators:

o Aruba EdgeConnect Enterprise Orchestrator (on-premises).

o Aruba EdgeConnect Enterprise Orchestrator-as-a-Service.

o Aruba EdgeConnect Enterprise Orchestrator-SP.

o Aruba EdgeConnect Enterprise Orchestrator Global.

• Enterprise Tenant Orchestrators:

o Orchestrator 9.2.1.40179 and below.

o Orchestrator 9.1.4.40436 and below.

o Orchestrator 9.0.7.40110 and below.

o Orchestrator 8.10.23.40015 and below.

o Any older branches of Orchestrator are not specifically mentioned.

It should be highlighted that versions of Aruba EdgeConnect Enterprise Orchestrator that are end-of-life are affected by these vulnerabilities unless otherwise indicated.