CVE-2023-37440

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-37440
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to conduct a server-side request forgery (SSRF) attack. A successful exploit allows an attacker to enumerate information about the internal     structure of the EdgeConnect SD-WAN Orchestrator host leading to potential disclosure of sensitive information.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:*
History

29 Aug 2023, 15:25

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
References (MISC) https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt - (MISC) https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt - Mitigation, Vendor Advisory
CPE cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:*
First Time Arubanetworks
Arubanetworks edgeconnect Sd-wan Orchestrator
CWE CWE-918

22 Aug 2023, 20:10

Type Values Removed Values Added
New CVE
Information

Published : 2023-08-22 19:16

Updated : 2023-12-10 15:14

NVD link : CVE-2023-37440

Mitre link : CVE-2023-37440

CVE.ORG link : CVE-2023-37440

JSON object : View

Products Affected

arubanetworks

  • edgeconnect_sd-wan_orchestrator
CWE
CWE-918

Server-Side Request Forgery (SSRF)