CVE-2022-43529
Estado: ModificadaMedia (5.4)—
A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an remote attacker to persist a session after a password reset or similar session clearing event. Successful exploitation of this vulnerability could allow an authenticated attacker to remain on the system with the permissions of their current session after the session should be invalidated in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Puntuación base: 5.4
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.43%
- Percentil entre todas las CVEs puntuadas: 35
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-384
- CWE-384
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2022-43529",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2022-43529",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-04-10T16:07:13.089329Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "security-alert@hpe.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 4.6,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 2.5,
"exploitabilityScore": 2.1
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.4,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 2.5,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "security-alert@hpe.com",
"affectedData": [
{
"vendor": "Hewlett Packard Enterprise (HPE)",
"product": "Aruba EdgeConnect Enterprise Orchestration Software",
"versions": [
{
"status": "affected",
"version": "Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned."
}
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2023-01-05T07:15:12.280",
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"source": "security-alert@hpe.com"
},
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-384"
}
]
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-384"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an remote attacker to persist a session after a password reset or similar session clearing event. Successful exploitation of this vulnerability could allow an authenticated attacker to remain on the system with the permissions of their current session after the session should be invalidated in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.\n\n"
},
{
"lang": "es",
"value": "Una vulnerabilidad en la interfaz de administración basada en web de Aruba EdgeConnect Enterprise Orchestrator podría permitir que un atacante remoto persista en una sesión después de un restablecimiento de contraseña o un evento similar de borrado de sesión. La explotación exitosa de esta vulnerabilidad podría permitir que un atacante autenticado permanezca en el sistema con los permisos de su sesión actual después de que la sesión se invalide en las versiones del software Aruba EdgeConnect Enterprise Orchestration: Aruba EdgeConnect Enterprise Orchestrator (local), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP y Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 y versiones anteriores, - Orchestrator 9.1.4.40436 y versiones anteriores, - Orchestrator 9.0.7.40110 y versiones anteriores, - Orchestrator 8.10.23.40015 y versiones anteriores: cualquier rama anterior de Orchestrator que no se mencione específicamente."
}
],
"lastModified": "2026-06-17T05:06:46.567",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:on-premises:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C105433F-3477-4632-A192-672219AF0CEA",
"versionEndIncluding": "8.10.23.40015"
},
{
"criteria": "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:on-premises:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BB3793BE-F70F-4495-9911-5900FD0C1BCB",
"versionEndIncluding": "9.0.7.40110",
"versionStartIncluding": "9.0.0"
},
{
"criteria": "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:on-premises:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C58AD722-2552-4D6B-A390-DDCEBE5F3726",
"versionEndIncluding": "9.1.4.40436",
"versionStartIncluding": "9.1.0"
},
{
"criteria": "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:on-premises:*:*:*",
"vulnerable": true,
"matchCriteriaId": "541AC697-70DD-4832-8DDE-D1EA38A1A880",
"versionEndIncluding": "9.2.1.40179",
"versionStartIncluding": "9.2.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:as-a-service:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B2F6BAE3-54F7-45EB-984C-0B08832867A6",
"versionEndIncluding": "8.10.23.40015"
},
{
"criteria": "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:as-a-service:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1003D598-16E2-4574-B3BB-D1466EA9ECFA",
"versionEndIncluding": "9.0.7.40110",
"versionStartIncluding": "9.0.0"
},
{
"criteria": "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:as-a-service:*:*:*",
"vulnerable": true,
"matchCriteriaId": "84E2C92F-3A9C-4072-9B1D-641C465933BD",
"versionEndIncluding": "9.1.4.40436",
"versionStartIncluding": "9.1.0"
},
{
"criteria": "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:as-a-service:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AB3DB912-1729-498E-8488-6BC653612C6F",
"versionEndIncluding": "9.2.1.40179",
"versionStartIncluding": "9.2.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:global_enterprise_tenant_orchestrators:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FB9D2623-6A8D-44D7-91BD-ED949A038093",
"versionEndIncluding": "8.10.23.40015"
},
{
"criteria": "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:global_enterprise_tenant_orchestrators:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4D27B112-874D-409F-88E4-1ECAE1C6C12E",
"versionEndIncluding": "9.0.7.40110",
"versionStartIncluding": "9.0.0"
},
{
"criteria": "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:global_enterprise_tenant_orchestrators:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FB5C1812-258C-4160-AA43-A2055356C74B",
"versionEndIncluding": "9.1.4.40436",
"versionStartIncluding": "9.1.0"
},
{
"criteria": "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:global_enterprise_tenant_orchestrators:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A5211AA6-5C28-4613-BD9A-96A644F84D03",
"versionEndIncluding": "9.2.1.40179",
"versionStartIncluding": "9.2.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:sp:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4F8E179A-99CE-4AA3-98F6-D7EC673789A1",
"versionEndIncluding": "8.10.23.40015"
},
{
"criteria": "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:sp:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CCE867DF-E468-460D-B016-5AE6929512FD",
"versionEndIncluding": "9.0.7.40110",
"versionStartIncluding": "9.0.0"
},
{
"criteria": "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:sp:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9213A4AD-3468-498C-8462-36BBF49FC7CA",
"versionEndIncluding": "9.1.4.40436",
"versionStartIncluding": "9.1.0"
},
{
"criteria": "cpe:2.3:a:arubanetworks:aruba_edgeconnect_enterprise_orchestrator:*:*:*:*:sp:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E23CDE96-A543-4075-B5CB-60EC87F5A4A3",
"versionEndIncluding": "9.2.1.40179",
"versionStartIncluding": "9.2.0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security-alert@hpe.com"
}